note 106771 deleted from function.imagecreatefromjpeg by thiago

Note Submitter: andreas g at gee em eks dot i n f o ---- some lib versions of the GD have a "multiple dot in filename" bug. For example you just put an upload form on your site, and after clicking the submit button you call the next page. There is probably a "move_uploaded_file" and "createimagefromuploaded". The second function fails if in the file ".htaccess.jpg" hasn't the magic bytes identifying a valid jpeg format but the function move_uploaded_file() cuts the last extension, leaving the filename as .htaccess As we well know this file defines access rights.... at least it allows to set 777 access rights in the chosen temp directory, and most programmers don't have the fantasy to change the directory path to something less guesable than "upload" or "file_tmp" - because they only copy&paste code examples. The next file was "i_am_now_root.sh.jpg" and the third one was "replace_index_html_with_my_stuff.sh.jpg". So a simple browser call "http://attacedwebsite.com/upload/replace_index_html_with_my_stuff.sh" succeeds - for gods sake he didn't cheat my upload noticication and I expected the worst by the first filename. Last but not least this security weakness can be worked around by checking multiple dots in a given filename, and of course, single dotted filenames are only pics if there appears a ".jpg" or ".png" or what ever the createimagefromjpeg can do.