Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Php bugs to potentially graveyard? #67

Open
AbhishekShah212 opened this issue Apr 15, 2021 · 0 comments
Open

Php bugs to potentially graveyard? #67

AbhishekShah212 opened this issue Apr 15, 2021 · 0 comments

Comments

@AbhishekShah212
Copy link

Thank you for this challenging and useful dataset. After reviewing some of the php bugs manually, I currently believe

MAE006 appears to be untriggerable with the current harness. The harness sets read_thumbnail=0. Consequently, ImageInfo.Thumbnail.data remains 0 and hence, the logical AND of MAE006 short circuits. Moreover, this effect results in an early exit from exif_scan_thumbnail; this likely explains why bugs MAE010 and MAE015 have never been reached.

MAE004 can be triggered by the current harness, but it is not detected by Magma. The bug condition relies on an architecture-dependent SIZE_MAX. Since dir_offset is a 32-bit value, the detection logic fails. The original bug report here confirms this property.

I am happy to provide POCs for demonstrability of both.

Given this information, should these bugs be moved to the graveyard or should the harnesses be fixed? What do you think?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant