Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:70598
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain wikimedia.org designates 208.80.152.186 as permitted sender)
Message-ID: <52A95137.4050505@wikimedia.org>
Date: Thu, 12 Dec 2013 17:01:27 +1100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.0
MIME-Version: 1.0
To: Stas Malyshev <smalyshev@sugarcrm.com>, 
 internals Mailing List <internals@lists.php.net>
CC: Marcus Boerger <helly@php.net>
References: <5281AE1C.4040108@wikimedia.org> <52A50402.6040303@sugarcrm.com>
In-Reply-To: <52A50402.6040303@sugarcrm.com>
OpenPGP: id=BF976370
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] EXIF integer overflow again
From: tstarling@wikimedia.org (Tim Starling)

On 09/12/13 10:42, Stas Malyshev wrote:
> Hi!
>
>> I just wanted to plug https://bugs.php.net/bug.php?id=65873 , since
>> it's been a month since I filed it and I've only had silence in
>> response, despite sending a private email to Stas about it.
> Could you check out this patch: https://github.com/php/php-src/pull/539
> It should fix this scenario. 

I commented there.

> I couldn't add a test though since only
> reproducing case is a 120M file and even for that special conditions are
> required. If you have better reproduction that could be used on test
> that would be most welcome.

Well, reproduction requires that the file be bigger than the heap
pointer, so to reproduce reliably, you really need both a large file
and some control over the heap pointer. I think the best you could do
in a .phpt would be to use an ENV section to customise the allocator,
then craft a highly compressible TIFF file and gzinflate() it to a
temporary directory during test execution. But even that would be
system-dependent.

-- Tim Starling