Skip to content

Commit

Permalink
Fix #76130: Heap Buffer Overflow (READ: 1786) in exif_iif_add_value
Browse files Browse the repository at this point in the history
The MakerNote is not necessarily null-terminated, so we must not use
`strlen()` to avoid OOB reads.  Instead `php_strnlen()` is the proper
way to handle this.
  • Loading branch information
cmb69 authored and smalyshev committed Apr 23, 2018
1 parent 36239fe commit b4e4788
Show file tree
Hide file tree
Showing 4 changed files with 21 additions and 1 deletion.
2 changes: 1 addition & 1 deletion ext/exif/exif.c
Original file line number Diff line number Diff line change
Expand Up @@ -1710,7 +1710,7 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
case TAG_FMT_UNDEFINED:
if (value) {
if (tag == TAG_MAKER_NOTE) {
length = MIN(length, strlen(value));
length = (int) php_strnlen(value, length);
}

/* do not recompute length here */
Expand Down
20 changes: 20 additions & 0 deletions ext/exif/tests/bug76130.phpt
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
--TEST--
Bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value)
--DESCRIPTION--
This test is meant to exhibit memory issues with the `-m` option. Since a lot of
notices and warnings are to be expected anyway, we suppress these, since the are
not relevant for this test.
--INI--
error_reporting=E_ALL & ~E_WARNING & ~E_NOTICE
--SKIPIF--
<?php
if (!extension_loaded('exif')) die('skip exif extension not available');
?>
--FILE--
<?php
exif_read_data(__DIR__ . '/bug76130_1.jpg');
exif_read_data(__DIR__ . '/bug76130_2.jpg');
?>
===DONE===
--EXPECT--
===DONE===
Binary file added ext/exif/tests/bug76130_1.jpg
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added ext/exif/tests/bug76130_2.jpg
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit b4e4788

Please sign in to comment.