Re: EXIF integer overflow again

On 09/12/13 10:42, Stas Malyshev wrote: > Hi! > >> I just wanted to plug https://bugs.php.net/bug.php?id=65873 >> , since >> it's been a month since I filed it and I've only had silence in >> response, despite sending a private email to Stas about it. > Could you check out this patch: Ö%áÖÛ§¿æà > fÈIhttps://github.com/php/php-src/pull/539 > It should fix this scenario. I commented there. > I couldn't add a test though since only > reproducing case is a 120M file and even for that special conditions are > required. If you have better reproduction that could be used on test > that would be most welcome. Well, reproduction requires that the file be bigger than the heap pointer, so to reproduce reliably, you really need both a large file and some control over the heap pointer. I think the best you could do in a .phpt would be to use an ENV section to customise the allocator, then craft a highly compressible TIFF file and gzinflate() it to a temporary directory during test execution. But even that would be system-dependent. -- Tim Starling