com php-src: Fix #70052: getimagesize() fails for very large and very small WBMP: ext/standard/image.c ext/standard/tests/image/bug70052.phpt
ext/standard/tests/image/bug70052_1.wbmp ext/ standard/tests/image/bug70052_2.wbmp

Commit: 87829c09a1d9e39bee994460d7ccf19dd20eda14 Author: Christoph M. Becker <cmb@php.net> Thu, 23 Jul 2015 18:13:47 +0200 Parents: 91f985b2f9b5ba03d7b98bdaa710331c115f6a70 Branches: PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=87829c09a1d9e39bee994460d7ccf19dd20eda14 Log: Fix #70052: getimagesize() fails for very large and very small WBMP Very large WBMP (width or height greater than 2**31-1) cause an overflow and circumvent the size limitation of 2048x2048 px. Very small WBMP (less than 12 bytes) cause a read error and are not recognized. This patch fixes both bugs. Bugs: https://bugs.php.net/70052 Changed paths: M ext/standard/image.c A ext/standard/tests/image/bug70052.phpt A ext/standard/tests/image/bug70052_1.wbmp A ext/standard/tests/image/bug70052_2.wbmp Diff: diff --git a/ext/standard/image.c b/ext/standard/image.c index 426a099..a240493 100644 --- a/ext/standard/image.c +++ b/ext/standard/image.c @@ -969,6 +969,10 @@ static int php_get_wbmp(php_stream *stream, struct gfxinfo **result, int check T return 0; } width = (width << 7) | (i & 0x7f); + /* maximum valid width for wbmp (although 127 may be a more accurate one) */ + if (width > 2048) { + return 0; + } } while (i & 0x80); /* get height */ @@ -978,10 +982,13 @@ static int php_get_wbmp(php_stream *stream, struct gfxinfo **result, int check T return 0; } height = (height << 7) | (i & 0x7f); + /* maximum valid heigth for wbmp (although 127 may be a more accurate one) */ + if (height > 2048) { + return 0; + } } while (i & 0x80); - /* maximum valid sizes for wbmp (although 127x127 may be a more accurate one) */ - if (!height || !width || height > 2048 || width > 2048) { + if (!height || !width) { return 0; } @@ -1223,6 +1230,7 @@ PHP_FUNCTION(image_type_to_extension) PHPAPI int php_getimagetype(php_stream * stream, char *filetype TSRMLS_DC) { char tmp[12]; + int twelve_bytes_read; if ( !filetype) filetype = tmp; if((php_stream_read(stream, filetype, 3)) != 3) { @@ -1273,12 +1281,11 @@ PHPAPI int php_getimagetype(php_stream * stream, char *filetype TSRMLS_DC) return IMAGE_FILETYPE_ICO; } - if (php_stream_read(stream, filetype+4, 8) != 8) { - php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Read error!"); - return IMAGE_FILETYPE_UNKNOWN; - } + /* WBMP may be smaller than 12 bytes, so delay error */ + twelve_bytes_read = (php_stream_read(stream, filetype+4, 8) == 8); + /* BYTES READ: 12 */ - if (!memcmp(filetype, php_sig_jp2, 12)) { + if (twelve_bytes_read && !memcmp(filetype, php_sig_jp2, 12)) { return IMAGE_FILETYPE_JP2; } @@ -1286,6 +1293,10 @@ PHPAPI int php_getimagetype(php_stream * stream, char *filetype TSRMLS_DC) if (php_get_wbmp(stream, NULL, 1 TSRMLS_CC)) { return IMAGE_FILETYPE_WBMP; } + if (!twelve_bytes_read) { + php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Read error!"); + return IMAGE_FILETYPE_UNKNOWN; + } if (php_get_xbm(stream, NULL TSRMLS_CC)) { return IMAGE_FILETYPE_XBM; } diff --git a/ext/standard/tests/image/bug70052.phpt b/ext/standard/tests/image/bug70052.phpt new file mode 100644 index 0000000..76ebda9 --- /dev/null +++ b/ext/standard/tests/image/bug70052.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #70052 (getimagesize() fails for very large and very small WBMP) +--FILE-- +<?php +var_dump(getimagesize(__DIR__ . '/bug70052_1.wbmp')); +var_dump(getimagesize(__DIR__ . '/bug70052_2.wbmp')); +?> +--EXPECT-- +bool(false) +array(5) { + [0]=> + int(3) + [1]=> + int(3) + [2]=> + int(15) + [3]=> + string(20) "width="3" height="3"" + ["mime"]=> + string(18) "image/vnd.wap.wbmp" +} diff --git a/ext/standard/tests/image/bug70052_1.wbmp b/ext/standard/tests/image/bug70052_1.wbmp new file mode 100644 index 0000000..2c32f37 Binary files /dev/null and b/ext/standard/tests/image/bug70052_1.wbmp differ diff --git a/ext/standard/tests/image/bug70052_2.wbmp b/ext/standard/tests/image/bug70052_2.wbmp new file mode 100644 index 0000000...d0f4313 Binary files /dev/null and b/ext/standard/tests/image/bug70052_2..wbmp differ