php/sme8/php-5.3.3-CVE-2014-3670.patch

bug68113.phpt removed as binary patch not supported


From 287c91c1f060dc85a8bdb51488c50db8614448b7 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Sun, 28 Sep 2014 16:57:42 -0700
Subject: [PATCH] Fix bug #68113 (Heap corruption in exif_thumbnail())

---
 NEWS                         |   6 +++++-
 ext/exif/exif.c              |   4 ++--
 ext/exif/tests/bug68113.jpg  | Bin 0 -> 368 bytes
 ext/exif/tests/bug68113.phpt |  17 +++++++++++++++++
 4 files changed, 24 insertions(+), 3 deletions(-)
 create mode 100755 ext/exif/tests/bug68113.jpg
 create mode 100644 ext/exif/tests/bug68113.phpt

diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index 38907b4..637ebf9 100644
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -2446,11 +2446,11 @@ static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel
                                        data_ptr += 8;
                                        break;
                                case TAG_FMT_SINGLE:
-                                       memmove(data_ptr, &info_data->value.f, byte_count);
+                                       memmove(data_ptr, &info_value->f, 4);
                                        data_ptr += 4;
                                        break;
                                case TAG_FMT_DOUBLE:
-                                       memmove(data_ptr, &info_data->value.d, byte_count);
+                                       memmove(data_ptr, &info_value->d, 8);
                                        data_ptr += 8;
                                        break;
                        }
-- 
2.1.0

1	vip-ire	1.1	bug68113.phpt removed as binary patch not supported
2
3
4			From 287c91c1f060dc85a8bdb51488c50db8614448b7 Mon Sep 17 00:00:00 2001
5			From: Stanislav Malyshev <stas@php.net>
6			Date: Sun, 28 Sep 2014 16:57:42 -0700
7			Subject: [PATCH] Fix bug #68113 (Heap corruption in exif_thumbnail())
8
9			---
10			NEWS \| 6 +++++-
11			ext/exif/exif.c \| 4 ++--
12			ext/exif/tests/bug68113.jpg \| Bin 0 -> 368 bytes
13			ext/exif/tests/bug68113.phpt \| 17 +++++++++++++++++
14			4 files changed, 24 insertions(+), 3 deletions(-)
15			create mode 100755 ext/exif/tests/bug68113.jpg
16			create mode 100644 ext/exif/tests/bug68113.phpt
17
18			diff --git a/ext/exif/exif.c b/ext/exif/exif.c
19			index 38907b4..637ebf9 100644
20			--- a/ext/exif/exif.c
21			+++ b/ext/exif/exif.c
22			@@ -2446,11 +2446,11 @@ static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel
23			data_ptr += 8;
24			break;
25			case TAG_FMT_SINGLE:
26			- memmove(data_ptr, &info_data->value.f, byte_count);
27			+ memmove(data_ptr, &info_value->f, 4);
28			data_ptr += 4;
29			break;
30			case TAG_FMT_DOUBLE:
31			- memmove(data_ptr, &info_data->value.d, byte_count);
32			+ memmove(data_ptr, &info_value->d, 8);
33			data_ptr += 8;
34			break;
35			}
36			--
37			2.1.0
38