Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:70599
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.53 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <52A95137.4050505@wikimedia.org>
References: <5281AE1C.4040108@wikimedia.org>
	<52A50402.6040303@sugarcrm.com>
	<52A95137.4050505@wikimedia.org>
Date: Thu, 12 Dec 2013 07:07:38 +0100
Message-ID: <CAEZPtU4drXReQdDu3F6MqEkCL2b02kF_KaqtfJCFKgu6nz-AHg@mail.gmail.com>
To: Tim Starling <tstarling@wikimedia.org>
Cc: Stas Malyshev <smalyshev@sugarcrm.com>, 
	internals Mailing List <internals@lists.php.net>, Marcus Boerger <helly@php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] EXIF integer overflow again
From: pierre.php@gmail.com (Pierre Joye)

On Thu, Dec 12, 2013 at 7:01 AM, Tim Starling <tstarling@wikimedia.org> wrote:
> On 09/12/13 10:42, Stas Malyshev wrote:
>> Hi!
>>
>>> I just wanted to plug https://bugs.php.net/bug.php?id=65873 , since
>>> it's been a month since I filed it and I've only had silence in
>>> response, despite sending a private email to Stas about it.
>> Could you check out this patch: https://github.com/php/php-src/pull/539
>> It should fix this scenario.
>
> I commented there.
>
>> I couldn't add a test though since only
>> reproducing case is a 120M file and even for that special conditions are
>> required. If you have better reproduction that could be used on test
>> that would be most welcome.
>
> Well, reproduction requires that the file be bigger than the heap
> pointer, so to reproduce reliably, you really need both a large file
> and some control over the heap pointer. I think the best you could do
> in a .phpt would be to use an ENV section to customise the allocator,
> then craft a highly compressible TIFF file and gzinflate() it to a
> temporary directory during test execution. But even that would be
> system-dependent.

In any case, we can live without a test for this fix, better to have
it without test than no fix at all.

But generating it at runtime during the test run sounds like a good
solution. While I am not sure yet about a good way to craft a TIFF to
fit the crash requirements, we have no API to get the heap size (not
sure it is displayed by bintools).

Cheers,
-- 
Pierre

@pierrejoye | http://www.libgd.org