From f989a4cd44f1bbabc6cdba9af1477125a8ba2f56 Mon Sep 17 00:00:00 2001 From: Nikita Popov Date: Sun, 22 Sep 2019 12:10:17 +0200 Subject: [PATCH] Fix leak of temporary buffer during exif tag reading --- ext/exif/exif.c | 2 ++ ext/exif/tests/temporary_buffer_leak.jpg | Bin 0 -> 46 bytes ext/exif/tests/temporary_buffer_leak.phpt | 10 ++++++++++ 3 files changed, 12 insertions(+) create mode 100644 ext/exif/tests/temporary_buffer_leak.jpg create mode 100644 ext/exif/tests/temporary_buffer_leak.phpt diff --git a/ext/exif/exif.c b/ext/exif/exif.c index 01b54012f46..9b4adffb434 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -3588,9 +3588,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha Subdir_start = offset_base + php_ifd_get32u(value_ptr, ImageInfo->motorola_intel); if (Subdir_start < offset_base || Subdir_start > offset_base+IFDlength) { exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD Pointer"); + EFREE_IF(outside); return FALSE; } if (!exif_process_IFD_in_JPEG(ImageInfo, Subdir_start, offset_base, IFDlength, displacement, sub_section_index, tag)) { + EFREE_IF(outside); return FALSE; } #ifdef EXIF_DEBUG diff --git a/ext/exif/tests/temporary_buffer_leak.jpg b/ext/exif/tests/temporary_buffer_leak.jpg new file mode 100644 index 0000000000000000000000000000000000000000..c9f7ce821feffedf597fa3936b509d7cbbe49699 GIT binary patch literal 46 scmex=;~|5BYei-n1B0(GgBAk=0|x_Rd**)yAWIR585AJkKZyDd032BgzyJUM literal 0 HcmV?d00001 diff --git a/ext/exif/tests/temporary_buffer_leak.phpt b/ext/exif/tests/temporary_buffer_leak.phpt new file mode 100644 index 00000000000..cf136dd6486 --- /dev/null +++ b/ext/exif/tests/temporary_buffer_leak.phpt @@ -0,0 +1,10 @@ +--TEST-- +OSS-Fuzz: Temporary buffer leak in tag reading +--FILE-- + +--EXPECT-- +bool(false)