diff options
| author | Remi Collet <remi@remirepo.net> | 2019-03-04 14:07:43 +0100 |
|---|---|---|
| committer | Remi Collet <remi@remirepo.net> | 2019-03-04 14:07:43 +0100 |
| commit | 9263effd14b58fdcb883b9388511ed58e28e07d0 (patch) | |
| tree | dfaf28eeb611be9e985df026425098a77bc866aa /php-bug77563.patch | |
| parent | 3a917cf6f47526008157164b7a5dac88bb590c53 (diff) | |
- exif:
Fix #77509 Uninitialized read in exif_process_IFD_in_TIFF
Fix #77540 Invalid Read on exif_process_SOFn
Fix #77563 Uninitialized read in exif_process_IFD_in_MAKERNOTE
Fix #77659 Uninitialized read in exif_process_IFD_in_MAKERNOTE
- phar:
Fix #77396 Null Pointer Dereference in phar_create_or_parse_filename
- spl:
Fix #77431 openFile() silently truncates after a null byte
Diffstat (limited to 'php-bug77563.patch')
| -rw-r--r-- | php-bug77563.patch | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/php-bug77563.patch b/php-bug77563.patch new file mode 100644 index 0000000..3070e2a --- /dev/null +++ b/php-bug77563.patch @@ -0,0 +1,42 @@ +Backported for 7.0 by remi +without binary diff + + + +From 8ac6fee8562533a15db90062117210ed28b44fea Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev <stas@php.net> +Date: Sat, 2 Mar 2019 15:07:40 -0800 +Subject: [PATCH] Fix bug #77563 - Uninitialized read in + exif_process_IFD_in_MAKERNOTE + +Also fix for bug #77659 +--- + ext/exif/exif.c | 3 ++- + ext/exif/tests/bug77563.jpg | Bin 0 -> 63 bytes + ext/exif/tests/bug77563.phpt | 16 ++++++++++++++++ + 3 files changed, 18 insertions(+), 1 deletion(-) + create mode 100644 ext/exif/tests/bug77563.jpg + create mode 100644 ext/exif/tests/bug77563.phpt + +diff --git a/ext/exif/exif.c b/ext/exif/exif.c +index ea88a8f115e8..fe89b8547118 100644 +--- a/ext/exif/exif.c ++++ b/ext/exif/exif.c +@@ -2740,7 +2740,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu + break; + } + +- if (maker_note->offset >= value_len) { ++ if (value_len < 2 || maker_note->offset >= value_len - 1) { + /* Do not go past the value end */ + exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset); + return FALSE; +@@ -2793,6 +2793,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu + break; + default: + case MN_OFFSET_NORMAL: ++ data_len = value_len; + break; + } + + |