Re: EXIF integer overflow again
| From: | Rasmus Lerdorf | Date: | Tue, 12 Nov 2013 05:19:39 +0000 |
| Subject: | Re: EXIF integer overflow again | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-70101@lists.php.net to get a copy of this message | ||
On 11/11/2013 08:27 PM, Tim Starling wrote:
> Hi,
>
> I just wanted to plug https://bugs.php.net/bug.php?id=65873 ,
> since
> it's been a month since I filed it and I've only had silence in
> response, despite sending a private email to Stas about it.
>
> Sam Reed has reproduced this crash with two different PHP builds, with
> no special configuration. CVE-2011-4566 (bug 60150) was from the same
> line of code, which is kind of ridiculous. It'd be nice if someone
> could have a closer look at the extension as a whole this time around,
> maybe get rid of those offset_base pointers, rather than just doing a
> one-line patch.
I think you just volunteered.
-Rasmus