Bug #62523 [Com]: php crashes with segfault when exif_read_data called
Edit report at https://bugs.php.net/bug.php?id=62523edit=1 ID: 62523 Comment by: dominic dot benson at thirdlight dot com Reported by:bigbug at mafia dot lv Summary:php crashes with segfault when exif_read_data called Status: Assigned Type: Bug Package:Reproducible crash Operating System: linux PHP Version:5.3Git-2012-07-10 (snap) Assigned To:rasmus Block user comment: N Private report: N New Comment: I encountered a similar issue reading EXIF from a TIFF, the below patch fixes both my original TIFF issue, and the issue with file 1.orig.jpg linked in the original report for me. Environment: Linux amd64/i686 (Debian 5/6/7, Ubuntu 13.04) PHP version: 5.3.25 SAPI: CLI/FastCGI Required for the JPEG fix is a change from int type for offset_diff in exif_process_IFD_in_MAKERNOTE. I've changed it to size_t, which is semantically correct for Linux, but I think this isn't portable to Win. Essentially, the issue is that values read from the file are treated as offsets, and used to manipulate the offset_base. Patch (agains 5.3.25) follows: diff -rupN php-5.3.25.orig/ext/exif/exif.c php-5.3.25/ext/exif/exif.c --- php-5.3.25.orig/ext/exif/exif.c 2013-05-08 16:58:52.0 +0100 +++ php-5.3.25/ext/exif/exif.c 2013-05-21 14:59:59.579438565 +0100 @@ -2745,7 +2745,8 @@ static int exif_process_unicode(image_in static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * value_ptr, int value_len, char *offset_base, size_t IFDlength, size_t displacement TSRMLS_DC) { int de, i=0, section_index = SECTION_MAKERNOTE; - int NumDirEntries, old_motorola_intel, offset_diff; + int NumDirEntries, old_motorola_intel; + size_t offset_diff; const maker_note_type *maker_note; char *dir_start; @@ -2921,6 +2922,12 @@ static int exif_process_IFD_TAG(image_in } } } else { + if (value_ptroffset_base) { +#ifdef EXIF_DEBUG + exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, EXIF invalid: offset_base (x%016llX) exceed value_ptr (x%016llX), offset_base, value_ptr); +#endif + return FALSE; + } /* 4 bytes or less and value is in the dir entry itself */ value_ptr = dir_entry+8; offset_val= value_ptr-offset_base; @@ -3724,6 +3731,12 @@ static int exif_process_IFD_in_TIFF(imag exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, Next IFD: %s done, exif_get_sectionname(sub_section_index)); #endif } else { + if(dir_offset ImageInfo-file.list[sn].data) { +#ifdef EXIF_DEBUG + exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, Skip processing: dir_offset (x%016llX) exceeds data pointer (x%016llX), ImageInfo-file.list[sn].data, dir_offset); +#endif + return FALSE; + } if (!exif_process_IFD_TAG(ImageInfo, (char*)dir_entry, (char*)(ImageInfo-file.list[sn].data-dir_offset), ifd_size, 0, section_index, 0, tag_table TSRMLS_CC)) { Previous Comments: [2012-12-12 12:33:03] dessander at gmail dot com Same situation with file: http://dl.dropbox.com/u/7562584/Bugs/Php/bad_exif.jpeg [2012-10-30 13:26:09] alex at bartl dot net seeing the same issue on php-5.4.7-10.fc17.x86_64 (Fedora 17) [2012-09-14 17:25:50] info at getid3 dot org I am also seeing the same problem on Windows (7-64-pro) running php-5.4.7-nts-Win32-VC9-x86 (and previously same thing on v5.4.4) I have only encountered one of my own files that causes the crash: http://getid3.org/temp/62523.jpg [2012-07-11 03:35:59] larue...@php.net Rasmus, could you please look at this one? I have no enough knowledge of the exif things :) [2012-07-11 03:33:59] larue...@php.net I can reproduce this only in 5.3, seems 5.3 and 5.4 have the same exif code, but can not reproduce this in 5.4. #0 0x2b6649bdd8fe in php_ifd_get16u (value=0xcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1095 1095
Bug #62523 [Com]: php crashes with segfault when exif_read_data called
Edit report at https://bugs.php.net/bug.php?id=62523edit=1 ID: 62523 Comment by: dessander at gmail dot com Reported by:bigbug at mafia dot lv Summary:php crashes with segfault when exif_read_data called Status: Assigned Type: Bug Package:Reproducible crash Operating System: linux PHP Version:5.3Git-2012-07-10 (snap) Assigned To:rasmus Block user comment: N Private report: N New Comment: Same situation with file: http://dl.dropbox.com/u/7562584/Bugs/Php/bad_exif.jpeg Previous Comments: [2012-10-30 13:26:09] alex at bartl dot net seeing the same issue on php-5.4.7-10.fc17.x86_64 (Fedora 17) [2012-09-14 17:25:50] info at getid3 dot org I am also seeing the same problem on Windows (7-64-pro) running php-5.4.7-nts-Win32-VC9-x86 (and previously same thing on v5.4.4) I have only encountered one of my own files that causes the crash: http://getid3.org/temp/62523.jpg [2012-07-11 03:35:59] larue...@php.net Rasmus, could you please look at this one? I have no enough knowledge of the exif things :) [2012-07-11 03:33:59] larue...@php.net I can reproduce this only in 5.3, seems 5.3 and 5.4 have the same exif code, but can not reproduce this in 5.4. #0 0x2b6649bdd8fe in php_ifd_get16u (value=0xcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1095 1095return (((uchar *)value)[1] 8) | ((uchar *)value)[0]; (gdb) bt #0 0x2b6649bdd8fe in php_ifd_get16u (value=0xcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1095 #1 0x2b6649bdeba8 in exif_iif_add_value (image_info=0x7fff7b6ec450, section_index=13, name=0x7fff7b6ebbb0 CustomFunctions, tag=15, format=3, length=12, value=0xcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1762 #2 0x2b6649bded63 in exif_iif_add_tag (image_info=0x7fff7b6ec450, section_index=13, name=0x7fff7b6ebbb0 CustomFunctions, tag=15, format=3, length=12, value=0xcc675e60) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1812 #3 0x2b6649be23e3 in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb512d8 \017, offset_base=0xcc67493c Address 0xcc67493c out of bounds, IFDlength=13482, displacement=30, section_index=13, ReadNextIFD=0, tag_table=0x2b6649de9b00) at /home/huixinchen/opensource/php- 5.3/ext/exif/exif.c:3135 #4 0x2b6649be123b in exif_process_IFD_in_MAKERNOTE (ImageInfo=0x7fff7b6ec450, value_ptr=0x1eb512ca \027, value_len=3476, offset_base=0xcc67493c Address 0xcc67493c out of bounds, IFDlength=13482, displacement=30) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:2813 #5 0x2b6649be221f in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb5085c |\222\a, offset_base=0x1eb4fec0 II*, IFDlength=13482, displacement=30, section_index=7, ReadNextIFD=1, tag_table=0x2b6649de88e0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3089 #6 0x2b6649be256f in exif_process_IFD_in_JPEG (ImageInfo=0x7fff7b6ec450, dir_start=0x1eb507b2 \037, offset_base=0x1eb4fec0 II*, IFDlength=13482, displacement=30, section_index=7) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3163 #7 0x2b6649be2385 in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb4ff36 i\207\004, offset_base=0x1eb4fec0 II*, IFDlength=13482, displacement=30, section_index=3, ReadNextIFD=1, tag_table=0x2b6649de88e0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3126 #8 0x2b6649be256f in exif_process_IFD_in_JPEG (ImageInfo=0x7fff7b6ec450, dir_start=0x1eb4fec8 \v, offset_base=0x1eb4fec0 II*, IFDlength=13482, displacement=30, section_index=3) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3163 #9 0x2b6649be285a in exif_process_TIFF_in_JPEG (ImageInfo=0x7fff7b6ec450, CharBuf=0x1eb4fec0 II*, length=13482, displacement=30) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3240 #10 0x2b6649be298c in exif_process_APP1 (ImageInfo=0x7fff7b6ec450, CharBuf=0x1eb4feb8 4²Exif, length=13490, displacement=22) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3265 #11 0x2b6649be2f1d in exif_scan_JPEG_header (ImageInfo=0x7fff7b6ec450) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3410 #12 0x2b6649be3ffd in exif_scan_FILE_header (ImageInfo=0x7fff7b6ec450) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3792 #13 0x2b6649be4c41 in exif_read_file (ImageInfo=0x7fff7b6ec450, FileName=0x1eb4b8e8 /tmp/1.orig.jpg,
Bug #62523 [Com]: php crashes with segfault when exif_read_data called
Edit report at https://bugs.php.net/bug.php?id=62523edit=1 ID: 62523 Comment by: alex at bartl dot net Reported by:bigbug at mafia dot lv Summary:php crashes with segfault when exif_read_data called Status: Assigned Type: Bug Package:Reproducible crash Operating System: linux PHP Version:5.3Git-2012-07-10 (snap) Assigned To:rasmus Block user comment: N Private report: N New Comment: seeing the same issue on php-5.4.7-10.fc17.x86_64 (Fedora 17) Previous Comments: [2012-09-14 17:25:50] info at getid3 dot org I am also seeing the same problem on Windows (7-64-pro) running php-5.4.7-nts-Win32-VC9-x86 (and previously same thing on v5.4.4) I have only encountered one of my own files that causes the crash: http://getid3.org/temp/62523.jpg [2012-07-11 03:35:59] larue...@php.net Rasmus, could you please look at this one? I have no enough knowledge of the exif things :) [2012-07-11 03:33:59] larue...@php.net I can reproduce this only in 5.3, seems 5.3 and 5.4 have the same exif code, but can not reproduce this in 5.4. #0 0x2b6649bdd8fe in php_ifd_get16u (value=0xcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1095 1095return (((uchar *)value)[1] 8) | ((uchar *)value)[0]; (gdb) bt #0 0x2b6649bdd8fe in php_ifd_get16u (value=0xcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1095 #1 0x2b6649bdeba8 in exif_iif_add_value (image_info=0x7fff7b6ec450, section_index=13, name=0x7fff7b6ebbb0 CustomFunctions, tag=15, format=3, length=12, value=0xcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1762 #2 0x2b6649bded63 in exif_iif_add_tag (image_info=0x7fff7b6ec450, section_index=13, name=0x7fff7b6ebbb0 CustomFunctions, tag=15, format=3, length=12, value=0xcc675e60) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1812 #3 0x2b6649be23e3 in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb512d8 \017, offset_base=0xcc67493c Address 0xcc67493c out of bounds, IFDlength=13482, displacement=30, section_index=13, ReadNextIFD=0, tag_table=0x2b6649de9b00) at /home/huixinchen/opensource/php- 5.3/ext/exif/exif.c:3135 #4 0x2b6649be123b in exif_process_IFD_in_MAKERNOTE (ImageInfo=0x7fff7b6ec450, value_ptr=0x1eb512ca \027, value_len=3476, offset_base=0xcc67493c Address 0xcc67493c out of bounds, IFDlength=13482, displacement=30) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:2813 #5 0x2b6649be221f in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb5085c |\222\a, offset_base=0x1eb4fec0 II*, IFDlength=13482, displacement=30, section_index=7, ReadNextIFD=1, tag_table=0x2b6649de88e0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3089 #6 0x2b6649be256f in exif_process_IFD_in_JPEG (ImageInfo=0x7fff7b6ec450, dir_start=0x1eb507b2 \037, offset_base=0x1eb4fec0 II*, IFDlength=13482, displacement=30, section_index=7) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3163 #7 0x2b6649be2385 in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb4ff36 i\207\004, offset_base=0x1eb4fec0 II*, IFDlength=13482, displacement=30, section_index=3, ReadNextIFD=1, tag_table=0x2b6649de88e0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3126 #8 0x2b6649be256f in exif_process_IFD_in_JPEG (ImageInfo=0x7fff7b6ec450, dir_start=0x1eb4fec8 \v, offset_base=0x1eb4fec0 II*, IFDlength=13482, displacement=30, section_index=3) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3163 #9 0x2b6649be285a in exif_process_TIFF_in_JPEG (ImageInfo=0x7fff7b6ec450, CharBuf=0x1eb4fec0 II*, length=13482, displacement=30) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3240 #10 0x2b6649be298c in exif_process_APP1 (ImageInfo=0x7fff7b6ec450, CharBuf=0x1eb4feb8 4²Exif, length=13490, displacement=22) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3265 #11 0x2b6649be2f1d in exif_scan_JPEG_header (ImageInfo=0x7fff7b6ec450) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3410 #12 0x2b6649be3ffd in exif_scan_FILE_header (ImageInfo=0x7fff7b6ec450) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3792 #13 0x2b6649be4c41 in exif_read_file (ImageInfo=0x7fff7b6ec450, FileName=0x1eb4b8e8 /tmp/1.orig.jpg, read_thumbnail=0, read_all=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3931 #14 0x2b6649be4e27 in zif_exif_read_data (ht=1, return_value=0x1eb4aac0, return_value_ptr=0x0, this_ptr=0x0,
Bug #62523 [Com]: php crashes with segfault when exif_read_data called
Edit report at https://bugs.php.net/bug.php?id=62523edit=1 ID: 62523 Comment by: info at getid3 dot org Reported by:bigbug at mafia dot lv Summary:php crashes with segfault when exif_read_data called Status: Assigned Type: Bug Package:Reproducible crash Operating System: linux PHP Version:5.3Git-2012-07-10 (snap) Assigned To:rasmus Block user comment: N Private report: N New Comment: I am also seeing the same problem on Windows (7-64-pro) running php-5.4.7-nts-Win32-VC9-x86 (and previously same thing on v5.4.4) I have only encountered one of my own files that causes the crash: http://getid3.org/temp/62523.jpg Previous Comments: [2012-07-11 03:35:59] larue...@php.net Rasmus, could you please look at this one? I have no enough knowledge of the exif things :) [2012-07-11 03:33:59] larue...@php.net I can reproduce this only in 5.3, seems 5.3 and 5.4 have the same exif code, but can not reproduce this in 5.4. #0 0x2b6649bdd8fe in php_ifd_get16u (value=0xcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1095 1095return (((uchar *)value)[1] 8) | ((uchar *)value)[0]; (gdb) bt #0 0x2b6649bdd8fe in php_ifd_get16u (value=0xcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1095 #1 0x2b6649bdeba8 in exif_iif_add_value (image_info=0x7fff7b6ec450, section_index=13, name=0x7fff7b6ebbb0 CustomFunctions, tag=15, format=3, length=12, value=0xcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1762 #2 0x2b6649bded63 in exif_iif_add_tag (image_info=0x7fff7b6ec450, section_index=13, name=0x7fff7b6ebbb0 CustomFunctions, tag=15, format=3, length=12, value=0xcc675e60) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1812 #3 0x2b6649be23e3 in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb512d8 \017, offset_base=0xcc67493c Address 0xcc67493c out of bounds, IFDlength=13482, displacement=30, section_index=13, ReadNextIFD=0, tag_table=0x2b6649de9b00) at /home/huixinchen/opensource/php- 5.3/ext/exif/exif.c:3135 #4 0x2b6649be123b in exif_process_IFD_in_MAKERNOTE (ImageInfo=0x7fff7b6ec450, value_ptr=0x1eb512ca \027, value_len=3476, offset_base=0xcc67493c Address 0xcc67493c out of bounds, IFDlength=13482, displacement=30) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:2813 #5 0x2b6649be221f in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb5085c |\222\a, offset_base=0x1eb4fec0 II*, IFDlength=13482, displacement=30, section_index=7, ReadNextIFD=1, tag_table=0x2b6649de88e0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3089 #6 0x2b6649be256f in exif_process_IFD_in_JPEG (ImageInfo=0x7fff7b6ec450, dir_start=0x1eb507b2 \037, offset_base=0x1eb4fec0 II*, IFDlength=13482, displacement=30, section_index=7) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3163 #7 0x2b6649be2385 in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb4ff36 i\207\004, offset_base=0x1eb4fec0 II*, IFDlength=13482, displacement=30, section_index=3, ReadNextIFD=1, tag_table=0x2b6649de88e0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3126 #8 0x2b6649be256f in exif_process_IFD_in_JPEG (ImageInfo=0x7fff7b6ec450, dir_start=0x1eb4fec8 \v, offset_base=0x1eb4fec0 II*, IFDlength=13482, displacement=30, section_index=3) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3163 #9 0x2b6649be285a in exif_process_TIFF_in_JPEG (ImageInfo=0x7fff7b6ec450, CharBuf=0x1eb4fec0 II*, length=13482, displacement=30) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3240 #10 0x2b6649be298c in exif_process_APP1 (ImageInfo=0x7fff7b6ec450, CharBuf=0x1eb4feb8 4²Exif, length=13490, displacement=22) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3265 #11 0x2b6649be2f1d in exif_scan_JPEG_header (ImageInfo=0x7fff7b6ec450) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3410 #12 0x2b6649be3ffd in exif_scan_FILE_header (ImageInfo=0x7fff7b6ec450) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3792 #13 0x2b6649be4c41 in exif_read_file (ImageInfo=0x7fff7b6ec450, FileName=0x1eb4b8e8 /tmp/1.orig.jpg, read_thumbnail=0, read_all=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3931 #14 0x2b6649be4e27 in zif_exif_read_data (ht=1, return_value=0x1eb4aac0, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3984 #15 0x008e7d95 in zend_do_fcall_common_helper_SPEC (execute_data=0x2b664a23b090) at
Bug #62523 [Com]: php crashes with segfault when exif_read_data called
Edit report at https://bugs.php.net/bug.php?id=62523edit=1 ID: 62523 Comment by: bigbug at mafia dot lv Reported by:bigbug at mafia dot lv Summary:php crashes with segfault when exif_read_data called Status: Open Type: Bug Package:Reproducible crash Operating System: linux PHP Version:5.3Git-2012-07-10 (snap) Block user comment: N Private report: N New Comment: The file causing crash http://2000.lv/1.orig.jpg Previous Comments: [2012-07-10 13:55:24] bigbug at mafia dot lv Description: i got the jpeg file which is crashing our production server when exif_read_data is called. I have testet with latest 5.3 snapshot, same there. Same results for 5.2 version, same results with 32 or 64bit versions. Test script: --- ?php exif_read_data(1.orig.jpg); ? Expected result: return the array of exif data Actual result: -- Reading symbols from /usr/bin/php...(no debugging symbols found)...done. [New LWP 27266] warning: Can't read pathname for load map: Input/output error. [Thread debugging using libthread_db enabled] Core was generated by `php filed.php'. Program terminated with signal 11, Segmentation fault. #0 0x080e5046 in ?? () (gdb) bt #0 0x080e5046 in ?? () #1 0x080e561d in ?? () #2 0x080e60b3 in ?? () #3 0x080e6bbe in ?? () #4 0x080e70ef in ?? () #5 0x080e6e00 in ?? () #6 0x080e70ef in ?? () #7 0x080e906c in ?? () #8 0x080e92c2 in ?? () #9 0x083985ca in ?? () #10 0x0834344e in execute () #11 0x0831c199 in zend_execute_scripts () #12 0x082c2dce in php_execute_script () #13 0x0806b47f in ?? () #14 0x0077c113 in __libc_start_main () from /lib/i386-linux-gnu/libc.so.6 #15 0x0806b521 in _start () Shoid i build php with debug symbols? -- Edit this bug report at https://bugs.php.net/bug.php?id=62523edit=1