| 1 |
|
| 2 |
https://bugzilla.redhat.com/show_bug.cgi?id=680972 |
| 3 |
|
| 4 |
http://svn.php.net/viewvc?view=revision&revision=308316 |
| 5 |
http://svn.php.net/viewvc?view=revision&revision=308317 |
| 6 |
http://svn.php.net/viewvc?view=revision&revision=308362 |
| 7 |
|
| 8 |
--- php-5.3.3/ext/exif/exif.c.cve0708 |
| 9 |
+++ php-5.3.3/ext/exif/exif.c |
| 10 |
@@ -40,6 +40,16 @@ |
| 11 |
#include "php.h" |
| 12 |
#include "ext/standard/file.h" |
| 13 |
|
| 14 |
+#ifdef HAVE_STDINT_H |
| 15 |
+# include <stdint.h> |
| 16 |
+#endif |
| 17 |
+#ifdef HAVE_INTTYPES_H |
| 18 |
+# include <inttypes.h> |
| 19 |
+#endif |
| 20 |
+#ifdef PHP_WIN32 |
| 21 |
+# include "win32/php_stdint.h" |
| 22 |
+#endif |
| 23 |
+ |
| 24 |
#if HAVE_EXIF |
| 25 |
|
| 26 |
/* When EXIF_DEBUG is defined the module generates a lot of debug messages |
| 27 |
@@ -2821,6 +2831,7 @@ static int exif_process_IFD_TAG(image_in |
| 28 |
int tag, format, components; |
| 29 |
char *value_ptr, tagname[64], cbuf[32], *outside=NULL; |
| 30 |
size_t byte_count, offset_val, fpos, fgot; |
| 31 |
+ int64_t byte_count_signed; |
| 32 |
xp_field_type *tmp_xp; |
| 33 |
#ifdef EXIF_DEBUG |
| 34 |
char *dump_data; |
| 35 |
@@ -2845,13 +2856,20 @@ static int exif_process_IFD_TAG(image_in |
| 36 |
/*return TRUE;*/ |
| 37 |
} |
| 38 |
|
| 39 |
- byte_count = components * php_tiff_bytes_per_format[format]; |
| 40 |
+ if (components < 0) { |
| 41 |
+ exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%ld)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), components); |
| 42 |
+ return FALSE; |
| 43 |
+ } |
| 44 |
+ |
| 45 |
+ byte_count_signed = (int64_t)components * php_tiff_bytes_per_format[format]; |
| 46 |
|
| 47 |
- if ((ssize_t)byte_count < 0) { |
| 48 |
- exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal byte_count(%ld)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), byte_count); |
| 49 |
+ if (byte_count_signed < 0 || (byte_count_signed > INT32_MAX)) { |
| 50 |
+ exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal byte_count", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC)); |
| 51 |
return FALSE; |
| 52 |
} |
| 53 |
|
| 54 |
+ byte_count = (size_t)byte_count_signed; |
| 55 |
+ |
| 56 |
if (byte_count > 4) { |
| 57 |
offset_val = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel); |
| 58 |
/* If its bigger than 4 bytes, the dir entry contains an offset. */ |
| 59 |
@@ -2916,6 +2934,7 @@ static int exif_process_IFD_TAG(image_in |
| 60 |
efree(dump_data); |
| 61 |
} |
| 62 |
#endif |
| 63 |
+ |
| 64 |
if (section_index==SECTION_THUMBNAIL) { |
| 65 |
if (!ImageInfo->Thumbnail.data) { |
| 66 |
switch(tag) { |
Parent Directory
| 
Revision Log
| 
Revision Graph
