Sec Bug->Bug #79046 [Opn->Ver]: NaN to int cast undefined behavior in exif

Edit report at https://bugs.php.net/bug.php?id=79046&edit=1 ID: 79046 Updated by: nikic@php.net Reported by: wxhusst at gmail dot com -Summary: UndefinedBehaviorSanitizer: undefined-behavior +Summary: NaN to int cast undefined behavior in exif -Status: Open +Status: Verified -Type: Security +Type: Bug Package: EXIF related Operating System: linux PHP Version: 7.4.1 Block user comment: N Private report: Y New Comment: This was partially addressed in https://github.com/php/php-src/commit/dd997a40d0be9b03973b1317041f92ad9582237f, but the NaN case wasn't handled. Reclassifying as normal bug as this UBSan violation does not result in an actual miscompile. Previous Comments: ------------------------------------------------------------------------ [2019-12-30 03:37:32] wxhusst at gmail dot com Description: ------------ exif_read_data may lead to integer overflow raven@ubuntu ~/p/s/cli (master)> ./php -r 'exif_read_data("/home/raven/php-src/crash-7cd841466926b2ce76d75b379568282a0fc8914b", "IFD0");' /home/raven/php-src/ext/exif/exif.c:1677:10: runtime error: nan is outside the range of representable values of type 'unsigned long' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/raven/php-src/ext/exif/exif.c:1677:10 in sorry, no backtrace for gdb the file https://github.com/loveraven42/poc/blob/master/crash-7cd841466926b2ce76d75b379568282a0fc8914b Test script: --------------- ./php -r 'exif_read_data("/home/raven/php-src/crash-7cd841466926b2ce76d75b379568282a0fc8914b", "IFD0"); ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=79046&edit=1