cvs: php-src(PHP_5_2) / NEWS /ext/gd/libgd gd_png.c /ext/gd/tests libgd00086.phpt libgd00086.png

pajoye Wed May 16 22:19:08 2007 UTC Added files: (Branch: PHP_5_2) /php-src/ext/gd/tests libgd00086.phpt libgd00086.png Modified files: /php-src NEWS /php-src/ext/gd/libgd gd_png.c Log: - MFH: libgd #86: Fixed possible infinite loop in libgd/gd_png.c (Reported by Xavier Roche) http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.711&r2=1.2027.2.547.2.712&diff_format=u Index: php-src/NEWS diff -u php-src/NEWS:1.2027.2.547.2.711 php-src/NEWS:1.2027.2.547.2.712 --- php-src/NEWS:1.2027.2.547.2.711 Wed May 16 21:22:12 2007 +++ php-src/NEWS Wed May 16 22:19:07 2007 @@ -8,6 +8,8 @@ altered at run time. (Scott) - Allow SOAP extension's handler() to work even when always_populate_raw_post_data is off. (Ilia) +- Fixed possible infinite loop in imagepng (libgd #86) (by Xavier Roche) + (Pierre) - Fixed ext/filter Email Validation Vulnerability (MOPB-24 by Stefan Esser) (Ilia) - Fixed altering $this via argument named "this". (Dmitry) http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/gd_png.c?r1=1.17.4.2.2.4&r2=1.17.4.2.2.5&diff_format=u Index: php-src/ext/gd/libgd/gd_png.c diff -u php-src/ext/gd/libgd/gd_png.c:1.17.4.2.2.4 php-src/ext/gd/libgd/gd_png.c:1.17.4.2.2.5 --- php-src/ext/gd/libgd/gd_png.c:1.17.4.2.2.4 Sun Dec 10 01:38:01 2006 +++ php-src/ext/gd/libgd/gd_png.c Wed May 16 22:19:08 2007 @@ -71,7 +71,11 @@ static void gdPngReadData (png_structp png_ptr, png_bytep data, png_size_t length) { - gdGetBuf(data, length, (gdIOCtx *) png_get_io_ptr(png_ptr)); + int check; + check = gdGetBuf(data, length, (gdIOCtx *) png_get_io_ptr(png_ptr)); + if (check != length) { + png_error(png_ptr, "Read Error: truncated data"); + } } static void gdPngWriteData (png_structp png_ptr, png_bytep data, png_size_t length) http://cvs.php.net/viewvc.cgi/php-src/ext/gd/tests/libgd00086.phpt?view=markup&rev=1.1 Index: php-src/ext/gd/tests/libgd00086.phpt +++ php-src/ext/gd/tests/libgd00086.phpt --TEST-- Bug #39780 (PNG image with CRC/data error raises a fatal error) --SKIPIF-- <?php if (!extension_loaded('gd')) die("skip gd extension not available\n"); if (!GD_BUNDLED) die('skip external GD libraries always fail'); ?> --FILE-- <?php $im = imagecreatefrompng(dirname(__FILE__) . '/libgd00086.png'); var_dump($im); ?> --EXPECTF-- Warning: imagecreatefrompng(): gd-png: fatal libpng error: Read Error: truncated data in %s on line %d Warning: imagecreatefrompng(): gd-png error: setjmp returns error condition in %s on line %d Warning: imagecreatefrompng(): '%s' is not a valid PNG file in %s on line %d bool(false)