archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix GH-16409: Segfault in exif_thumbnail when not dealing with a real file

Browse source 
Closes GH-16416.
This commit is contained in:
Niels Dossche 2024-10-13 18:02:00 +02:00
parent d70b7811b0
commit 3843f0ecfe
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
3 changed files with 17 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
NEWS
View file

@ -17,6 +17,10 @@ PHP NEWS
. Fixed bug GH-16316 (DOMXPath breaks when not initialized properly). . Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
(nielsdos) (nielsdos)
- EXIF:
. Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a
real file). (nielsdos, cmb)
- GD: - GD:
. Fixed bug GH-16334 (imageaffine overflow on matrix elements). . Fixed bug GH-16334 (imageaffine overflow on matrix elements).
(David Carlier) (David Carlier)

2
ext/exif/exif.c
View file

@ -4419,7 +4419,7 @@ static bool exif_read_from_impl(image_info_type *ImageInfo, php_stream *stream,
ImageInfo->FileName = NULL; ImageInfo->FileName = NULL;
if (php_stream_is(ImageInfo->infile, PHP_STREAM_IS_STDIO)) { if (php_stream_is(ImageInfo->infile, PHP_STREAM_IS_STDIO)) {
if (VCWD_STAT(stream->orig_path, &st) >= 0) { if (stream->orig_path && VCWD_STAT(stream->orig_path, &st) >= 0) {
zend_string *base; zend_string *base;
if ((st.st_mode & S_IFMT) != S_IFREG) { if ((st.st_mode & S_IFMT) != S_IFREG) {
exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Not a file"); exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Not a file");

12
ext/exif/tests/gh16409.phpt Normal file
View file

@ -0,0 +1,12 @@
--TEST--
GH-16409 (Segfault in exif_thumbnail when not dealing with a real file)
--EXTENSIONS--
exif
--FILE--
<?php
$stream = popen('echo 1', 'r');
var_dump(exif_thumbnail($stream, $pipes, $stream, $pipes));
?>
--EXPECTF--
Warning: exif_thumbnail(): File too small (0) in %s on line %d
bool(false)%A