From 03cb94d7835b8548cd35966c0cf3e10e48808f87 Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@remirepo.net>
Date: Thu, 1 Mar 2018 09:50:30 +0100
Subject: fix #73549: Use after free when stream is passed to imagepng fix
 #73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx() CVE-2016-10167 fix
 #73869: Signed Integer Overflow gd_io.c CVE-2016-10168 fix #74435: Buffer
 over-read into uninitialized memory CVE-2017-7890 fix #75571: Potential
 infinite loop in gdImageCreateFromGifCtx CVE-2018-5711 fix #75981:
 stack-buffer-overflow while parsing HTTP response

---
 bug75571.patch | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 bug75571.patch

(limited to 'bug75571.patch')

diff --git a/bug75571.patch b/bug75571.patch
new file mode 100644
index 0000000..d35ca3a
--- /dev/null
+++ b/bug75571.patch
@@ -0,0 +1,58 @@
+Backported for 5.4 without test and binary patch
+
+From 8d6e9588671136837533fe3785657c31c5b52767 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69@gmx.de>
+Date: Wed, 29 Nov 2017 18:52:33 +0100
+Subject: [PATCH] Fixed bug #75571: Potential infinite loop in
+ gdImageCreateFromGifCtx
+
+Due to a signedness confusion in `GetCode_` a corrupt GIF file can
+trigger an infinite loop.  Furthermore we make sure that a GIF without
+any palette entries is treated as invalid *after* open palette entries
+have been removed.
+---
+ ext/gd/libgd/gd_gif_in.c   |  10 +++++-----
+ ext/gd/tests/bug75571.gif  | Bin 0 -> 1731 bytes
+ ext/gd/tests/bug75571.phpt |  15 +++++++++++++++
+ 3 files changed, 20 insertions(+), 5 deletions(-)
+ create mode 100644 ext/gd/tests/bug75571.gif
+ create mode 100644 ext/gd/tests/bug75571.phpt
+
+diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
+index e0f0fe3..16776d3 100644
+--- a/ext/gd/libgd/gd_gif_in.c
++++ b/ext/gd/libgd/gd_gif_in.c
+@@ -261,10 +261,6 @@ terminated:
+ 	if (!im) {
+ 		return 0;
+ 	}
+-	if (!im->colorsTotal) {
+-		gdImageDestroy(im);
+-		return 0;
+-	}
+ 	/* Check for open colors at the end, so
+ 	   we can reduce colorsTotal and ultimately
+ 	   BitsPerPixel */
+@@ -275,6 +271,10 @@ terminated:
+ 			break;
+ 		}
+ 	}
++	if (!im->colorsTotal) {
++		gdImageDestroy(im);
++		return 0;
++	}
+ 	return im;
+ }
+ /* }}} */
+@@ -375,7 +375,7 @@ static int
+ GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP)
+ {
+ 	int           i, j, ret;
+-	unsigned char count;
++	int           count;
+ 
+ 	if (flag) {
+ 		scd->curbit = 0;
+-- 
+2.1.4
+
-- 
cgit