EXIF integer overflow again
| From: | Tim Starling | Date: | Tue, 12 Nov 2013 04:27:08 +0000 |
| Subject: | EXIF integer overflow again | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-70100@lists.php.net to get a copy of this message | ||
Hi,
I just wanted to plug https://bugs.php.net/bug.php?id=65873 , since
it's been a month since I filed it and I've only had silence in
response, despite sending a private email to Stas about it.
Sam Reed has reproduced this crash with two different PHP builds, with
no special configuration. CVE-2011-4566 (bug 60150) was from the same
line of code, which is kind of ridiculous. It'd be nice if someone
could have a closer look at the extension as a whole this time around,
maybe get rid of those offset_base pointers, rather than just doing a
one-line patch.
-- Tim Starling