From cc08cbc84d46933c1e9e0149633f1ed5d19e45e9 Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Thu, 13 Oct 2016 11:10:02 +0200 Subject: [PATCH] Fix #73280: Stack Buffer Overflow in GD dynamicGetbuf We make sure to never pass a negative `rlen` as size to memcpy(). Cf. . --- NEWS | 1 + ext/gd/libgd/gd_io_dp.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index d9e6b4c1d3..415050456f 100644 --- a/NEWS +++ b/NEWS @@ -7,6 +7,7 @@ PHP NEWS . Fixed bug #73272 (imagescale() is not affected by, but affects imagesetinterpolation()). (cmb) . Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()). (cmb) + . Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf). (cmb) - SOAP: . Fixed bug #73037 (SoapServer reports Bad Request when gzipped). (Anatol) diff --git a/ext/gd/libgd/gd_io_dp.c b/ext/gd/libgd/gd_io_dp.c index bfeb4cb4bb..4dcedde8cc 100644 --- a/ext/gd/libgd/gd_io_dp.c +++ b/ext/gd/libgd/gd_io_dp.c @@ -237,7 +237,7 @@ static int dynamicGetbuf (gdIOCtxPtr ctx, void *buf, int len) if (remain >= len) { rlen = len; } else { - if (remain == 0) { + if (remain <= 0) { return EOF; } rlen = remain; -- 2.49.0