pajoye Thu Jul 17 23:13:09 2008 UTC Added files: (Branch: PHP_5_3) /php-src/ext/gd/tests imageloadfont_invalid.phpt
Modified files: /php-src/ext/gd gd.c Log: - MFB: fix crash when some crafted font are given http://cvs.php.net/viewvc.cgi/php-src/ext/gd/gd.c?r1=1.312.2.20.2.32.2.10&r2=1.312.2.20.2.32.2.11&diff_format=u Index: php-src/ext/gd/gd.c diff -u php-src/ext/gd/gd.c:1.312.2.20.2.32.2.10 php-src/ext/gd/gd.c:1.312.2.20.2.32.2.11 --- php-src/ext/gd/gd.c:1.312.2.20.2.32.2.10 Tue Jul 8 15:24:12 2008 +++ php-src/ext/gd/gd.c Thu Jul 17 23:13:09 2008 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: gd.c,v 1.312.2.20.2.32.2.10 2008/07/08 15:24:12 tony2001 Exp $ */ +/* $Id: gd.c,v 1.312.2.20.2.32.2.11 2008/07/17 23:13:09 pajoye Exp $ */ /* gd 1.2 is copyright 1994, 1995, Quest Protein Database Center, Cold Spring Harbor Labs. */ @@ -1634,6 +1634,19 @@ body_size = font->w * font->h * font->nchars; } + if (overflow2(font->nchars, font->h)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Error reading font, invalid font header"); + efree(font); + php_stream_close(stream); + RETURN_FALSE; + } + if (overflow2(font->nchars * font->h, font->w )) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Error reading font, invalid font header"); + efree(font); + php_stream_close(stream); + RETURN_FALSE; + } + if (body_size != body_size_check) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Error reading font"); efree(font); http://cvs.php.net/viewvc.cgi/php-src/ext/gd/tests/imageloadfont_invalid.phpt?view=markup&rev=1.1 Index: php-src/ext/gd/tests/imageloadfont_invalid.phpt +++ php-src/ext/gd/tests/imageloadfont_invalid.phpt -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php