Skip to content

Commit 4d2560d

Browse files
cmb69smalyshev
authored andcommitted
Fix #79877: getimagesize function silently truncates after a null byte
We have to check for NUL bytes if `getimagesize()` has been called.
1 parent 9c3171f commit 4d2560d

File tree

2 files changed

+14
-0
lines changed

2 files changed

+14
-0
lines changed

ext/standard/image.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1496,6 +1496,11 @@ static void php_getimagesize_from_any(INTERNAL_FUNCTION_PARAMETERS, int mode) {
14961496
Z_PARAM_ZVAL(info)
14971497
ZEND_PARSE_PARAMETERS_END();
14981498

1499+
if (mode == FROM_PATH && CHECK_NULL_PATH(input, input_len)) {
1500+
php_error_docref(NULL, E_WARNING, "Invalid path");
1501+
return;
1502+
}
1503+
14991504
if (argc == 2) {
15001505
info = zend_try_array_init(info);
15011506
if (!info) {
Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
--TEST--
2+
Bug #79877 (getimagesize function silently truncates after a null byte)
3+
--FILE--
4+
<?php
5+
var_dump(getimagesize("/tmp/a.png\0xx"));
6+
?>
7+
--EXPECTF--
8+
Warning: getimagesize(): Invalid path in %s on line %d
9+
NULL

0 commit comments

Comments
 (0)