Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix potential NULL pointer dereference in gdImageClone() #580

Conversation

fcabralpacheco
Copy link
Contributor

This PR fix a bug in the gdImageClone(), which can be used to generate a DoS condition on servers running PHP linked with the affected versions.

This patch has been improved (with the addition of tests) by @cmb69 .

CVE assigned: CVE-2018-14553

Original patch description:

`From 1e9d4d8a14619b7721cf1fc48a2260c24457418a Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" cmbecker69@gmx.de
Date: Fri, 20 Jul 2018 10:59:01 +0200
Subject: [PATCH] Fix potential NULL pointer dereference in gdImageClone()

If the image which should be cloned has set any style, the current code
which copies the style manually would dereference a NULL pointer. We
can simply remove this manual copying, since a few lines later in the
function we're already calling gdImageSetStyle() to copy the style
data. We have to make sure, though, to appropriately set the stylePos.

This security bug has been reported by Fabio Cabral Pacheco who also
provided the basic patch.`

@willson-chen
Copy link
Member

@cmb69 hi, could you please review this PR?

@fcabralpacheco Are you sure that the CVE ID(CVE-2018-14553) is assigned to libgd? I find it reserved in CVE Community. Could you please drop me a link?

@fcabralpacheco
Copy link
Contributor Author

@willson-chen yes, I requested the CVE, I will ask to update and make it public.

Thanks.

@fcabralpacheco
Copy link
Contributor Author

@willson-chen CVE update requested.

@cmb69
Copy link
Contributor

cmb69 commented Dec 20, 2019

Oops, I totally forgot about this one. Thanks for the reminder! Patch is fine; applied as a93eac0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants