Re: EXIF integer overflow again

Hi! > I just wanted to plug https://bugs.php.net/bug.php?id=65873 , > since > it's been a month since I filed it and I've only had silence in > response, despite sending a private email to Stas about it. Could you check out this patch: https://github.com/php/php-src/pull/539 It should fix this scenario. I couldn't add a test though since only reproducing case is a 120M file and even for that special conditions are required. If you have better reproduction that could be used on test that would be most welcome. > Sam Reed has reproduced this crash with two different PHP builds, with > no special configuration. CVE-2011-4566 (bug 60150) was from the same > line of code, which is kind of ridiculous. It'd be nice if someone > could have a closer look at the extension as a whole this time around, > maybe get rid of those offset_base pointers, rather than just doing a > one-line patch. I agree that offset_base, especially when it turns to negative pseudo-pointer, looks strange, but fixing it goes beyond my understanding of EXIF. Maybe Marcus (the extension maintainer) could take a look at it. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227