com php-src: Fix #74435: Buffer over-read into uninitialized memory: ext/gd/libgd/gd_gif_in.c ext/gd/tests/bug7443 5.gif ext/gd/tests/bug74435.phpt

Commit: 018092125538782b25d3ab6b036f0c8d5968f757 Author: Christoph M. Becker <cmbecker69@gmx.de> Tue, 20 Jun 2017 16:45:42 +0200 Committer: Joe Watkins <krakjoe@php.net> Thu, 6 Jul 2017 07:44:25 +0100 Parents: 88c521d659521f695e0b9e7fcdded0fc1ee1c53b Branches: PHP-7.1..7 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=018092125538782b25d3ab6b036f0c8d5968f757 Log: Fix #74435: Buffer over-read into uninitialized memory The stack allocated color map buffers were not zeroed before usage, and so undefined palette indexes could cause information leakage. Bugs: https://bugs.php.net/74435 Changed paths: M ext/gd/libgd/gd_gif_in.c A ext/gd/tests/bug74435.gif A ext/gd/tests/bug74435.phpt Diff: diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c index 74b7493..76ba152 100644 --- a/ext/gd/libgd/gd_gif_in.c +++ b/ext/gd/libgd/gd_gif_in.c @@ -147,6 +147,9 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd) /* {{{ */ int haveGlobalColormap; gdImagePtr im = 0; + memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE); + memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE); + /*1.4//imageNumber = 1; */ if (! ReadOK(fd,buf,6)) { return 0; diff --git a/ext/gd/tests/bug74435.gif b/ext/gd/tests/bug74435.gif new file mode 100644 index 0000000..92fbb7f Binary files /dev/null and b/ext/gd/tests/bug74435.gif differ diff --git a/ext/gd/tests/bug74435.phpt b/ext/gd/tests/bug74435.phpt new file mode 100644 index 0000000..9d11eb3 --- /dev/null +++ b/ext/gd/tests/bug74435.phpt @@ -0,0 +1,27 @@ +--TEST-- +Bug #74435 (Buffer over-read into uninitialized memory) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available'); +?> +--FILE-- +<?php +$im = imagecreatefromgif(__DIR__ . DIRECTORY_SEPARATOR . 'bug74435.gif'); +var_dump($im); +$width = imagesx($im); +$height = imagesy($im); +for ($i = 0; $i < $width; $i += 16) { + for ($j = 0; $j < $height; $j += 16) { + if (($index = imagecolorat($im, $i, $j)) >= 2) { + list($red, $green, $blue, $alpha) = array_values(imagecolorsforindex($im, $index)); + if ($red !== 0 || $green !== 0 || $blue !== 0 || $alpha !== 0) { + echo "unexpected color at ($i, $j)\n"; + } + } + } +} +?> +===DONE=== +--EXPECTF-- +resource(%d) of type (gd) +===DONE===