From: Stanislav Malyshev <stas@php.net>
Date: Sun, 28 Sep 2014 23:57:42 +0000 (-0700)
Subject: Fix bug #68113 (Heap corruption in exif_thumbnail())
X-Git-Tag: php-5.4.34~1
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=287c91c1f060dc85a8bdb51488c50db8614448b7;p=php

Fix bug #68113 (Heap corruption in exif_thumbnail())
---

diff --git a/NEWS b/NEWS
index b074f9f3cb..35193d1441 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,6 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2014, PHP 5.4.34
+16 Oct 2014, PHP 5.4.34
 
 - Fileinfo:
   . Fixed bug #66242 (libmagic: don't assume char is signed). (ArdB)
@@ -14,6 +14,10 @@ PHP                                                                        NEWS
 - cURL:
   . Fixed bug #68089 (NULL byte injection - cURL lib). (Stas)
 
+- EXIF:
+  . Fixed bug #68113 (Heap corruption in exif_thumbnail()). (CVE-2014-3670)
+    (Stas)
+
 - OpenSSL:
   . Reverted fixes for bug #41631, due to regressions. (Stas) 
 
diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index 38907b4d94..637ebf9289 100644
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -2426,11 +2426,11 @@ static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel
 					data_ptr += 8;
 					break;
 				case TAG_FMT_SINGLE:
-					memmove(data_ptr, &info_data->value.f, byte_count);
+					memmove(data_ptr, &info_value->f, 4);
 					data_ptr += 4;
 					break;
 				case TAG_FMT_DOUBLE:
-					memmove(data_ptr, &info_data->value.d, byte_count);
+					memmove(data_ptr, &info_value->d, 8);
 					data_ptr += 8;
 					break;
 			}
diff --git a/ext/exif/tests/bug68113.jpg b/ext/exif/tests/bug68113.jpg
new file mode 100755
index 0000000000..3ce7a620fb
Binary files /dev/null and b/ext/exif/tests/bug68113.jpg differ
diff --git a/ext/exif/tests/bug68113.phpt b/ext/exif/tests/bug68113.phpt
new file mode 100644
index 0000000000..0fa4c4aca8
--- /dev/null
+++ b/ext/exif/tests/bug68113.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #68113 (Heap corruption in exif_thumbnail())
+--SKIPIF--
+<?php
+extension_loaded("exif") or die("skip need exif");
+?>
+--FILE--
+<?php
+var_dump(exif_thumbnail(__DIR__."/bug68113.jpg"));
+?>
+Done
+--EXPECTF--
+Warning: exif_thumbnail(bug68113.jpg): File structure corrupted in %s/bug68113.php on line 2
+
+Warning: exif_thumbnail(bug68113.jpg): Invalid JPEG file in %s/bug68113.php on line 2
+bool(false)
+Done
\ No newline at end of file