Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:70540 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 81878 invoked from network); 8 Dec 2013 23:43:05 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 8 Dec 2013 23:43:05 -0000 Authentication-Results: pb1.pair.com smtp.mail=smalyshev@sugarcrm.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=smalyshev@sugarcrm.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain sugarcrm.com designates 108.166.43.99 as permitted sender) X-PHP-List-Original-Sender: smalyshev@sugarcrm.com X-Host-Fingerprint: 108.166.43.99 smtp99.ord1c.emailsrvr.com Linux 2.6 Received: from [108.166.43.99] ([108.166.43.99:45973] helo=smtp99.ord1c.emailsrvr.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 72/90-09781-50405A25 for ; Sun, 08 Dec 2013 18:43:04 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp5.relay.ord1c.emailsrvr.com (SMTP Server) with ESMTP id 7A9421B0083; Sun, 8 Dec 2013 18:42:58 -0500 (EST) X-Virus-Scanned: OK Received: by smtp5.relay.ord1c.emailsrvr.com (Authenticated sender: smalyshev-AT-sugarcrm.com) with ESMTPSA id 081EA1B007A; Sun, 8 Dec 2013 18:42:57 -0500 (EST) Message-ID: <52A50402.6040303@sugarcrm.com> Date: Sun, 08 Dec 2013 15:42:58 -0800 Organization: SugarCRM User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:24.0) Gecko/20100101 Thunderbird/24.1.1 MIME-Version: 1.0 To: Tim Starling , internals Mailing List CC: Marcus Boerger References: <5281AE1C.4040108@wikimedia.org> In-Reply-To: <5281AE1C.4040108@wikimedia.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Subject: Re: [PHP-DEV] EXIF integer overflow again From: smalyshev@sugarcrm.com (Stas Malyshev) Hi! > I just wanted to plug https://bugs.php.net/bug.php?id=65873 , since > it's been a month since I filed it and I've only had silence in > response, despite sending a private email to Stas about it. Could you check out this patch: https://github.com/php/php-src/pull/539 It should fix this scenario. I couldn't add a test though since only reproducing case is a 120M file and even for that special conditions are required. If you have better reproduction that could be used on test that would be most welcome. > Sam Reed has reproduced this crash with two different PHP builds, with > no special configuration. CVE-2011-4566 (bug 60150) was from the same > line of code, which is kind of ridiculous. It'd be nice if someone > could have a closer look at the extension as a whole this time around, > maybe get rid of those offset_base pointers, rather than just doing a > one-line patch. I agree that offset_base, especially when it turns to negative pseudo-pointer, looks strange, but fixing it goes beyond my understanding of EXIF. Maybe Marcus (the extension maintainer) could take a look at it. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227