mirror of
https://github.com/thead-yocto-mirror/meta-openembedded
synced 2026-07-21 07:17:58 +02:00
539119d170
Security Advisory References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11045 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11046 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11047 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11050 Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
58 lines
2.1 KiB
Diff
58 lines
2.1 KiB
Diff
From d348cfb96f2543565691010ade5e0346338be5a7 Mon Sep 17 00:00:00 2001
|
|
From: Stanislav Malyshev <stas@php.net>
|
|
Date: Mon, 16 Dec 2019 00:10:39 -0800
|
|
Subject: [PATCH] Fixed bug #78910
|
|
|
|
Upstream-Status: Accepted
|
|
CVE-2019-11047
|
|
|
|
Reference to upstream patch:
|
|
http://git.php.net/?p=php-src.git;a=commit;h=d348cfb96f2543565691010ade5e0346338be5a7
|
|
http://git.php.net/?p=php-src.git;a=commit;h=57325460d2bdee01a13d8e6cf03345c90543ff4f
|
|
---
|
|
ext/exif/exif.c | 3 ++-
|
|
ext/exif/tests/bug78910.phpt | 17 +++++++++++++++++
|
|
2 files changed, 19 insertions(+), 1 deletion(-)
|
|
create mode 100644 ext/exif/tests/bug78910.phpt
|
|
|
|
diff --git a/ext/exif/exif.c b/ext/exif/exif.c
|
|
index 2804807e..a5780113 100644
|
|
--- a/ext/exif/exif.c
|
|
+++ b/ext/exif/exif.c
|
|
@@ -3138,7 +3138,8 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
|
|
/*exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "check (%s)", maker_note->make?maker_note->make:"");*/
|
|
if (maker_note->make && (!ImageInfo->make || strcmp(maker_note->make, ImageInfo->make)))
|
|
continue;
|
|
- if (maker_note->id_string && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
|
|
+ if (maker_note->id_string && value_len >= maker_note->id_string_len
|
|
+ && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
|
|
continue;
|
|
break;
|
|
}
|
|
diff --git a/ext/exif/tests/bug78910.phpt b/ext/exif/tests/bug78910.phpt
|
|
new file mode 100644
|
|
index 00000000..f5b1c32c
|
|
--- /dev/null
|
|
+++ b/ext/exif/tests/bug78910.phpt
|
|
@@ -0,0 +1,17 @@
|
|
+--TEST--
|
|
+Bug #78910: Heap-buffer-overflow READ in exif (OSS-Fuzz #19044)
|
|
+--FILE--
|
|
+<?php
|
|
+
|
|
+var_dump(exif_read_data('data:image/jpg;base64,TU0AKgAAAAwgICAgAAIBDwAEAAAAAgAAACKSfCAgAAAAAEZVSklGSUxN'));
|
|
+
|
|
+?>
|
|
+--EXPECTF--
|
|
+Notice: exif_read_data(): Read from TIFF: tag(0x927C, MakerNote ): Illegal format code 0x2020, switching to BYTE in %s on line %d
|
|
+
|
|
+Warning: exif_read_data(): Process tag(x927C=MakerNote ): Illegal format code 0x2020, suppose BYTE in %s on line %d
|
|
+
|
|
+Warning: exif_read_data(): IFD data too short: 0x0000 offset 0x000C in %s on line %d
|
|
+
|
|
+Warning: exif_read_data(): Invalid TIFF file in %s on line %d
|
|
+bool(false)
|
|
--
|
|
2.17.1
|
|
|