Skip to content

Commit 757f4a9

Browse files
m6w6m6w6
committed
Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4: add tests for bug #62523 Merged PR #293 (Exif crash on unknown encoding was fixed) By: Draal Conflicts: configure.in main/php_version.h
2 parents b636c03 + 2fa5f39 commit 757f4a9

9 files changed

+94
-5
lines changed

‎ext/exif/exif.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2643,14 +2643,15 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
26432643
} else {
26442644
decode = ImageInfo->decode_unicode_le;
26452645
}
2646+
/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX */
26462647
if (zend_multibyte_encoding_converter(
26472648
(unsigned char**)pszInfoPtr,
26482649
&len,
26492650
(unsigned char*)szValuePtr,
26502651
ByteCount,
26512652
zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
26522653
zend_multibyte_fetch_encoding(decode TSRMLS_CC)
2653-
TSRMLS_CC) < 0) {
2654+
TSRMLS_CC) == (size_t)-1) {
26542655
len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
26552656
}
26562657
return len;
@@ -2663,14 +2664,15 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
26632664
*pszEncoding = estrdup((const char*)szValuePtr);
26642665
szValuePtr = szValuePtr+8;
26652666
ByteCount -= 8;
2667+
/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX */
26662668
if (zend_multibyte_encoding_converter(
26672669
(unsigned char**)pszInfoPtr,
26682670
&len,
26692671
(unsigned char*)szValuePtr,
26702672
ByteCount,
26712673
zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC),
26722674
zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le TSRMLS_CC)
2673-
TSRMLS_CC) < 0) {
2675+
TSRMLS_CC) == (size_t)-1) {
26742676
len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
26752677
}
26762678
return len;
@@ -2700,16 +2702,16 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
27002702
static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount TSRMLS_DC)
27012703
{
27022704
xp_field->tag = tag;
2703-
2704-
/* Copy the comment */
2705+
2706+
/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX */
27052707
if (zend_multibyte_encoding_converter(
27062708
(unsigned char**)&xp_field->value,
27072709
&xp_field->size,
27082710
(unsigned char*)szValuePtr,
27092711
ByteCount,
27102712
zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
27112713
zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_unicode_be : ImageInfo->decode_unicode_le TSRMLS_CC)
2712-
TSRMLS_CC) < 0) {
2714+
TSRMLS_CC) == (size_t)-1) {
27132715
xp_field->size = exif_process_string_raw(&xp_field->value, szValuePtr, ByteCount);
27142716
}
27152717
return xp_field->size;

‎ext/exif/tests/bug62523_1.jpg

Lines changed: 9 additions & 0 deletions
Loading

‎ext/exif/tests/bug62523_1.phpt

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
--TEST--
2+
Bug 62523 (php crashes with segfault when exif_read_data called)
3+
--SKIPIF--
4+
<?php
5+
extension_loaded("exif") or die("skip need exif");
6+
?>
7+
--FILE--
8+
<?php
9+
echo "Test\n";
10+
var_dump(count(exif_read_data(__DIR__."/bug62523_1.jpg")));
11+
?>
12+
Done
13+
--EXPECTF--
14+
Test
15+
16+
Warning: exif_read_data(bug62523_1.jpg): File not supported in %sbug62523_1.php on line %d
17+
int(1)
18+
Done

‎ext/exif/tests/bug62523_2.jpg

504 KB
Loading

‎ext/exif/tests/bug62523_2.phpt

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Bug 62523 (php crashes with segfault when exif_read_data called)
3+
--SKIPIF--
4+
<?php
5+
extension_loaded("exif") or die("skip need exif");
6+
?>
7+
--FILE--
8+
<?php
9+
echo "Test\n";
10+
var_dump(count(exif_read_data(__DIR__."/bug62523_2.jpg")));
11+
?>
12+
Done
13+
--EXPECT--
14+
Test
15+
int(76)
16+
Done

‎ext/exif/tests/bug62523_3.jpg

Lines changed: 12 additions & 0 deletions
Loading

‎ext/exif/tests/bug62523_3.phpt

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
--TEST--
2+
Bug 62523 (php crashes with segfault when exif_read_data called)
3+
--SKIPIF--
4+
<?php
5+
extension_loaded("exif") or die("skip need exif");
6+
?>
7+
--FILE--
8+
<?php
9+
echo "Test\n";
10+
var_dump(count(exif_read_data(__DIR__."/bug62523_3.jpg")));
11+
?>
12+
Done
13+
--EXPECTF--
14+
Test
15+
16+
Warning: exif_read_data(bug62523_3.jpg): File not supported in %sbug62523_3.php on line %d
17+
int(1)
18+
Done

‎ext/exif/tests/exif_encoding_crash.jpg

7.42 KB
Loading

‎ext/exif/tests/exif_encoding_crash.phpt

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
--TEST--
2+
PHP crash when zend_multibyte_encoding_converter returns (size_t)-1)
3+
--SKIPIF--
4+
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
5+
--FILE--
6+
<?php
7+
$infile = dirname(__FILE__).'/exif_encoding_crash.jpg';
8+
$exif_data = exif_read_data($infile);
9+
echo "*** no core dump ***\n";
10+
?>
11+
===DONE===
12+
--EXPECT--
13+
*** no core dump ***
14+
===DONE===

0 commit comments

Comments
 (0)