- MFH #38112, bad code size segfault

diff --git a/NEWS b/NEWS
index 808c5a5ecd0e8e7fedeb4d904d39523a94935b3a..03ee4e7282c4685da7104e7fb5197c3c33fef075 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,7 @@ PHP 4                                                                      NEWS
 - Improved safe_mode check for the error_log() function. (Ilia)
 - Fixed handling of extremely long paths inside tempnam() function. (Ilia)
 - Fixed XSS inside phpinfo() with long inputs. (Ilia)
+- Fixed bug #38112 (corrupted gif segfaults) (Pierre)
 - Fixed bug #37720 (merge_php_config scrambles values). (Mike,
   pumuckel at metropolis dot de)
 - Fixed bug #37569 (WDDX incorrectly encodes high-ascii characters). (Ilia)

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index 092c89a5d86d8f3ba014bf39a91123c60df767fd..8a937e13210ab2a0b6534b9f08270eb9659b55f7 100644 (file)
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -216,6 +216,12 @@ terminated:
        if (!im) {
                return 0;
        }
+
+               if (!im->colorsTotal) {
+                       gdImageDestroy(im);
+                       return 0;
+               }
+
        /* Check for open colors at the end, so
           we can reduce colorsTotal and ultimately
           BitsPerPixel */
@@ -506,6 +512,19 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned char (*cmap)
        int             v;
        int             xpos = 0, ypos = 0, pass = 0;
        int i;
+
+          /*
+               **  Initialize the Compression routines
+               */
+          if (! ReadOK(fd,&c,1)) {
+                  return;
+          }
+
+          if (c > MAX_LWZ_BITS) {
+                  return;      
+          }
+
+
        /* Stash the color map into the image */
        for (i=0; (i<gdMaxColors); i++) {
                im->red[i] = cmap[CM_RED][i];   
@@ -515,12 +534,7 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned char (*cmap)
        }
        /* Many (perhaps most) of these colors will remain marked open. */
        im->colorsTotal = gdMaxColors;
-       /*
-       **  Initialize the Compression routines
-       */
-       if (! ReadOK(fd,&c,1)) {
-               return; 
-       }
+
        if (LWZReadByte(fd, TRUE, c) < 0) {
                return;
        }

diff --git a/ext/gd/tests/bug38112.gif b/ext/gd/tests/bug38112.gif
new file mode 100644 (file)
index 0000000..178d27e
Binary files /dev/null and b/ext/gd/tests/bug38112.gif differ

diff --git a/ext/gd/tests/bug38112.phpt b/ext/gd/tests/bug38112.phpt
new file mode 100644 (file)
index 0000000..2a7cd4b
--- /dev/null
+++ b/ext/gd/tests/bug38112.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #38112 (GIF Invalid Code size ).
+--SKIPIF--
+<?php 
+       if (!extension_loaded('gd')) {  
+               die("skip gd extension not available\n");
+       }
+       if (!GD_BUNDLED) {
+               die('skip external GD libraries may fail');
+       }
+?>
+--FILE--
+<?php
+$im = imagecreatefromgif(dirname(__FILE__) . '/bug38112.gif');
+?>
+--EXPECTF--
+Warning: imagecreatefromgif() [%s]: '%sbug38112.gif' is not a valid GIF file in %sbug38112.php on line %d