summaryrefslogtreecommitdiffstats
path: root/php-bug77563.patch
diff options
context:
space:
mode:
Diffstat (limited to 'php-bug77563.patch')
-rw-r--r--php-bug77563.patch42
1 files changed, 42 insertions, 0 deletions
diff --git a/php-bug77563.patch b/php-bug77563.patch
new file mode 100644
index 0000000..3070e2a
--- /dev/null
+++ b/php-bug77563.patch
@@ -0,0 +1,42 @@
+Backported for 7.0 by remi
+without binary diff
+
+
+
+From 8ac6fee8562533a15db90062117210ed28b44fea Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas@php.net>
+Date: Sat, 2 Mar 2019 15:07:40 -0800
+Subject: [PATCH] Fix bug #77563 - Uninitialized read in
+ exif_process_IFD_in_MAKERNOTE
+
+Also fix for bug #77659
+---
+ ext/exif/exif.c | 3 ++-
+ ext/exif/tests/bug77563.jpg | Bin 0 -> 63 bytes
+ ext/exif/tests/bug77563.phpt | 16 ++++++++++++++++
+ 3 files changed, 18 insertions(+), 1 deletion(-)
+ create mode 100644 ext/exif/tests/bug77563.jpg
+ create mode 100644 ext/exif/tests/bug77563.phpt
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index ea88a8f115e8..fe89b8547118 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -2740,7 +2740,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
+ break;
+ }
+
+- if (maker_note->offset >= value_len) {
++ if (value_len < 2 || maker_note->offset >= value_len - 1) {
+ /* Do not go past the value end */
+ exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
+ return FALSE;
+@@ -2793,6 +2793,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
+ break;
+ default:
+ case MN_OFFSET_NORMAL:
++ data_len = value_len;
+ break;
+ }
+
+