Skip to content

Commit cfd9114

Browse files
m6w6m6w6
committed
Merge branch 'PHP-5.5'
* PHP-5.5: add tests for bug #62523 Merged PR #293 (Exif crash on unknown encoding was fixed) By: Draal Conflicts: configure.in main/php_version.h
2 parents 605b3c2 + 757f4a9 commit cfd9114

File tree

9 files changed

+94
-5
lines changed

9 files changed

+94
-5
lines changed

‎ext/exif/exif.c‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2633,14 +2633,15 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
26332633
} else {
26342634
decode = ImageInfo->decode_unicode_le;
26352635
}
2636+
/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX */
26362637
if (zend_multibyte_encoding_converter(
26372638
(unsigned char**)pszInfoPtr,
26382639
&len,
26392640
(unsigned char*)szValuePtr,
26402641
ByteCount,
26412642
zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
26422643
zend_multibyte_fetch_encoding(decode TSRMLS_CC)
2643-
TSRMLS_CC) < 0) {
2644+
TSRMLS_CC) == (size_t)-1) {
26442645
len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
26452646
}
26462647
return len;
@@ -2653,14 +2654,15 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
26532654
*pszEncoding = estrdup((const char*)szValuePtr);
26542655
szValuePtr = szValuePtr+8;
26552656
ByteCount -= 8;
2657+
/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX */
26562658
if (zend_multibyte_encoding_converter(
26572659
(unsigned char**)pszInfoPtr,
26582660
&len,
26592661
(unsigned char*)szValuePtr,
26602662
ByteCount,
26612663
zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC),
26622664
zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le TSRMLS_CC)
2663-
TSRMLS_CC) < 0) {
2665+
TSRMLS_CC) == (size_t)-1) {
26642666
len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
26652667
}
26662668
return len;
@@ -2690,16 +2692,16 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
26902692
static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount TSRMLS_DC)
26912693
{
26922694
xp_field->tag = tag;
2693-
2694-
/* Copy the comment */
2695+
2696+
/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX */
26952697
if (zend_multibyte_encoding_converter(
26962698
(unsigned char**)&xp_field->value,
26972699
&xp_field->size,
26982700
(unsigned char*)szValuePtr,
26992701
ByteCount,
27002702
zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
27012703
zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_unicode_be : ImageInfo->decode_unicode_le TSRMLS_CC)
2702-
TSRMLS_CC) < 0) {
2704+
TSRMLS_CC) == (size_t)-1) {
27032705
xp_field->size = exif_process_string_raw(&xp_field->value, szValuePtr, ByteCount);
27042706
}
27052707
return xp_field->size;

‎ext/exif/tests/bug62523_1.jpg‎

Lines changed: 9 additions & 0 deletions
Loading

‎ext/exif/tests/bug62523_1.phpt‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
--TEST--
2+
Bug 62523 (php crashes with segfault when exif_read_data called)
3+
--SKIPIF--
4+
<?php
5+
extension_loaded("exif") or die("skip need exif");
6+
?>
7+
--FILE--
8+
<?php
9+
echo "Test\n";
10+
var_dump(count(exif_read_data(__DIR__."/bug62523_1.jpg")));
11+
?>
12+
Done
13+
--EXPECTF--
14+
Test
15+
16+
Warning: exif_read_data(bug62523_1.jpg): File not supported in %sbug62523_1.php on line %d
17+
int(1)
18+
Done

‎ext/exif/tests/bug62523_2.jpg‎

504 KB
Loading

‎ext/exif/tests/bug62523_2.phpt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Bug 62523 (php crashes with segfault when exif_read_data called)
3+
--SKIPIF--
4+
<?php
5+
extension_loaded("exif") or die("skip need exif");
6+
?>
7+
--FILE--
8+
<?php
9+
echo "Test\n";
10+
var_dump(count(exif_read_data(__DIR__."/bug62523_2.jpg")));
11+
?>
12+
Done
13+
--EXPECT--
14+
Test
15+
int(76)
16+
Done

‎ext/exif/tests/bug62523_3.jpg‎

Lines changed: 12 additions & 0 deletions
Loading

‎ext/exif/tests/bug62523_3.phpt‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
--TEST--
2+
Bug 62523 (php crashes with segfault when exif_read_data called)
3+
--SKIPIF--
4+
<?php
5+
extension_loaded("exif") or die("skip need exif");
6+
?>
7+
--FILE--
8+
<?php
9+
echo "Test\n";
10+
var_dump(count(exif_read_data(__DIR__."/bug62523_3.jpg")));
11+
?>
12+
Done
13+
--EXPECTF--
14+
Test
15+
16+
Warning: exif_read_data(bug62523_3.jpg): File not supported in %sbug62523_3.php on line %d
17+
int(1)
18+
Done

‎ext/exif/tests/exif_encoding_crash.jpg‎

7.42 KB
Loading

‎ext/exif/tests/exif_encoding_crash.phpt‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
--TEST--
2+
PHP crash when zend_multibyte_encoding_converter returns (size_t)-1)
3+
--SKIPIF--
4+
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
5+
--FILE--
6+
<?php
7+
$infile = dirname(__FILE__).'/exif_encoding_crash.jpg';
8+
$exif_data = exif_read_data($infile);
9+
echo "*** no core dump ***\n";
10+
?>
11+
===DONE===
12+
--EXPECT--
13+
*** no core dump ***
14+
===DONE===

0 commit comments

Comments
 (0)