Skip to content

Commit e5324a2

Browse files
nikicnikic
committed
Limit the amount of errors generated during exif parsing
Emitting errors is fairly expensive, to the point that parsing a file with a huge number of invalid tags can take seconds. Generating ten thousand errors is unlikely to help anybody, but constitutes a potential DOS vector.
1 parent 81806db commit e5324a2

File tree

3 files changed

+18
-54
lines changed

3 files changed

+18
-54
lines changed

‎ext/exif/exif.c

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1939,16 +1939,29 @@ typedef struct {
19391939
int read_thumbnail;
19401940
int read_all;
19411941
int ifd_nesting_level;
1942+
int num_errors;
19421943
/* internal */
19431944
file_section_list file;
19441945
} image_info_type;
19451946
/* }}} */
19461947

1948+
#define EXIF_MAX_ERRORS 10
1949+
19471950
/* {{{ exif_error_docref */
1948-
static void exif_error_docref(const char *docref EXIFERR_DC, const image_info_type *ImageInfo, int type, const char *format, ...)
1951+
static void exif_error_docref(const char *docref EXIFERR_DC, image_info_type *ImageInfo, int type, const char *format, ...)
19491952
{
19501953
va_list args;
19511954

1955+
if (ImageInfo) {
1956+
if (++ImageInfo->num_errors > EXIF_MAX_ERRORS) {
1957+
if (ImageInfo->num_errors == EXIF_MAX_ERRORS+1) {
1958+
php_error_docref(docref, type,
1959+
"Further exif parsing errors have been suppressed");
1960+
}
1961+
return;
1962+
}
1963+
}
1964+
19521965
va_start(args, format);
19531966
#ifdef EXIF_DEBUG
19541967
{
@@ -4337,6 +4350,7 @@ static int exif_read_from_impl(image_info_type *ImageInfo, php_stream *stream, i
43374350

43384351

43394352
ImageInfo->ifd_nesting_level = 0;
4353+
ImageInfo->num_errors = 0;
43404354

43414355
/* Scan the headers */
43424356
ret = exif_scan_FILE_header(ImageInfo);

‎ext/exif/tests/bug76557.phpt

Lines changed: 1 addition & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -28,52 +28,6 @@ Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal f
2828

2929
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
3030

31-
Warning: exif_read_data(bug76557.jpg): Process tag(x8769=Exif_IFD_Po): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
32-
33-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
34-
35-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
36-
37-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
38-
39-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
40-
41-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
42-
43-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
44-
45-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
46-
47-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
48-
49-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
50-
51-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
52-
53-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
54-
55-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
56-
57-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
58-
59-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
60-
61-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
62-
63-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
64-
65-
Warning: exif_read_data(bug76557.jpg): Process tag(x927C=MakerNote ): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
66-
67-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
68-
69-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
70-
71-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
72-
73-
Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(%s) in %sbug76557.php on line %d
74-
75-
Warning: exif_read_data(bug76557.jpg): File structure corrupted in %sbug76557.php on line %d
76-
77-
Warning: exif_read_data(bug76557.jpg): Invalid JPEG file in %sbug76557.php on line %d
31+
Warning: exif_read_data(): Further exif parsing errors have been suppressed in %s on line %d
7832
bool(false)
7933
DONE

‎ext/exif/tests/bug77753.phpt

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,9 @@ Bug #77753 (Heap-buffer-overflow in php_ifd_get32s)
44
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
55
--FILE--
66
<?php
7-
var_dump(exif_read_data(__DIR__."/bug77753.tiff"));
7+
@var_dump(exif_read_data(__DIR__."/bug77753.tiff"));
88
?>
99
DONE
1010
--EXPECTF--
11-
%A
12-
Warning: exif_read_data(bug77753.tiff): Illegal IFD size: 0x006A > 0x0065 in %sbug77753.php on line %d
13-
14-
Warning: exif_read_data(bug77753.tiff): Invalid TIFF file in %sbug77753.php on line %d
1511
bool(false)
16-
DONE
12+
DONE

0 commit comments

Comments
 (0)