Skip to content

Commit fe9ed49

Browse files
committed
Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
We must not pretend that there are image data if there are none. Instead we fail reading the image file gracefully.
1 parent 60bfb40 commit fe9ed49

File tree

6 files changed

+35
-10
lines changed

6 files changed

+35
-10
lines changed

Diff for: src/gd_gd2.c

+6-8
Original file line numberDiff line numberDiff line change
@@ -503,18 +503,16 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromGd2Ctx (gdIOCtxPtr in)
503503

504504
if (im->trueColor) {
505505
if (!gdGetInt (&im->tpixels[y][x], in)) {
506-
/*printf("EOF while reading\n"); */
507-
/*gdImageDestroy(im); */
508-
/*return 0; */
509-
im->tpixels[y][x] = 0;
506+
gd_error("gd2: EOF while reading\n");
507+
gdImageDestroy(im);
508+
return NULL;
510509
}
511510
} else {
512511
int ch;
513512
if (!gdGetByte (&ch, in)) {
514-
/*printf("EOF while reading\n"); */
515-
/*gdImageDestroy(im); */
516-
/*return 0; */
517-
ch = 0;
513+
gd_error("gd2: EOF while reading\n");
514+
gdImageDestroy(im);
515+
return NULL;
518516
}
519517
im->pixels[y][x] = ch;
520518
}

Diff for: tests/gd2/.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,4 @@
66
/gd2_read
77
/gd2_read_corrupt
88
/php_bug_72339
9+
/too_few_image_data

Diff for: tests/gd2/CMakeLists.txt

+1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ LIST(APPEND TESTS_FILES
77
php_bug_72339
88
gd2_read
99
gd2_read_corrupt
10+
too_few_image_data
1011
)
1112

1213
ADD_GD_TESTS()

Diff for: tests/gd2/Makemodule.am

+5-2
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ libgd_test_programs += \
33
gd2/bug00309 \
44
gd2/gd2_empty_file \
55
gd2/php_bug_72339 \
6-
gd2/gd2_read_corrupt
6+
gd2/gd2_read_corrupt \
7+
gd2/too_few_image_data
78

89
if HAVE_LIBZ
910
libgd_test_programs += \
@@ -23,4 +24,6 @@ EXTRA_DIST += \
2324
gd2/conv_test_exp.png \
2425
gd2/empty.gd2 \
2526
gd2/invalid_header.gd2 \
26-
gd2/invalid_neg_size.gd2
27+
gd2/invalid_neg_size.gd2 \
28+
gd2/php_bug_72339_exp.gd2 \
29+
gd2/too_few_image_data.gd2

Diff for: tests/gd2/too_few_image_data.c

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/*
2+
too_few_image_data.gd2 claims to have a size of 12336x48 pixels, but doesn't
3+
provide as much image data. We test that gdImageCreateFromGd2Ctx() returns NULL
4+
in this case.
5+
*/
6+
7+
#include "gd.h"
8+
#include "gdtest.h"
9+
10+
int main()
11+
{
12+
gdImagePtr im;
13+
FILE *fp;
14+
15+
fp = gdTestFileOpen2("gd2", "too_few_image_data.gd2");
16+
gdTestAssert(fp != NULL);
17+
im = gdImageCreateFromGd2(fp);
18+
gdTestAssert(im == NULL);
19+
fclose(fp);
20+
21+
return gdNumFailures();
22+
}

Diff for: tests/gd2/too_few_image_data.gd2

1.03 KB
Binary file not shown.

0 commit comments

Comments
 (0)