com php-src: Fix bug #68113 (Heap corruption in exif_thumbnai l()): NEWS ext/exif/exif.c ext/exif/tests/bug 68113.jpg ext/exif/tests/bug68113.php t

Commit: 287c91c1f060dc85a8bdb51488c50db8614448b7 Author: Stanislav Malyshev <stas@php.net> Sun, 28 Sep 2014 16:57:42 -0700 Parents: ab0939e5e5449cba04b02fff3a5595f725bce0a0 Branches: PHP-5.4 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=287c91c1f060dc85a8bdb51488c50db8614448b7 Log: Fix bug #68113 (Heap corruption in exif_thumbnail()) Bugs: https://bugs.php.net/68113 Changed paths: M NEWS M ext/exif/exif.c A ext/exif/tests/bug68113.jpg A ext/exif/tests/bug68113.phpt Diff: diff --git a/NEWS b/NEWS index b074f9f..35193d1 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,6 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| -?? ??? 2014, PHP 5.4.34 +16 Oct 2014, PHP 5.4.34 - Fileinfo: . Fixed bug #66242 (libmagic: don't assume char is signed). (ArdB) @@ -14,6 +14,10 @@ PHP NEWS - cURL: . Fixed bug #68089 (NULL byte injection - cURL lib). (Stas) +- EXIF: + . Fixed bug #68113 (Heap corruption in exif_thumbnail()). (CVE-2014-3670) + (Stas) + - OpenSSL: . Reverted fixes for bug #41631, due to regressions. (Stas) diff --git a/ext/exif/exif.c b/ext/exif/exif.c index 38907b4...637ebf9 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -2426,11 +2426,11 @@ static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel data_ptr += 8; break; case TAG_FMT_SINGLE: - memmove(data_ptr, &info_data->value.f, byte_count); + memmove(data_ptr, &info_value->f, 4); data_ptr += 4; break; case TAG_FMT_DOUBLE: - memmove(data_ptr, &info_data->value.d, byte_count); + memmove(data_ptr, &info_value->d, 8); data_ptr += 8; break; } diff --git a/ext/exif/tests/bug68113.jpg b/ext/exif/tests/bug68113.jpg new file mode 100755 index 0000000..3ce7a62 Binary files /dev/null and b/ext/exif/tests/bug68113.jpg differ diff --git a/ext/exif/tests/bug68113.phpt b/ext/exif/tests/bug68113.phpt new file mode 100644 index 0000000..0fa4c4a --- /dev/null +++ b/ext/exif/tests/bug68113.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #68113 (Heap corruption in exif_thumbnail()) +--SKIPIF-- +<?php +extension_loaded("exif") or die("skip need exif"); +?> +--FILE-- +<?php +var_dump(exif_thumbnail(__DIR__.."/bug68113.jpg")); +?> +Done +--EXPECTF-- +Warning: exif_thumbnail(bug68113.jpg): File structure corrupted in %s/bug68113.php on line 2 + +Warning: exif_thumbnail(bug68113.jpg): Invalid JPEG file in %s/bug68113..php on line 2 +bool(false) +Done \ No newline at end of file