php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #38112 Segmentation fault in imagecreatefromgif
Submitted: 2006-07-16 10:05 UTC Modified: 2006-07-18 06:35 UTC
From: bduclaux at yahoo dot com Assigned: pajoye (profile)
Status: Closed Package: GD related
PHP Version: 5.1.4 OS: Linux
Private report: No CVE-ID: None
View Developer Edit
 [2006-07-16 10:05 UTC] bduclaux at yahoo dot com 
Description:
------------
imagecreatefromgif segfaults when broken gif images are loaded

Reproduce code:
---------------
<?php
$im=imagecreatefromgif("http://www.compuworldfrance.com/boutique/images_produits/26HEBOITIER0010_1.gif");
?>

Expected result:
----------------
Should not segfault !

Actual result:
--------------
The bug comes from the file php-5.1.4/ext/gd/libgd/gd_gif_in.c:394

Here is the full trace :
(gdb) bt
#0  LWZReadByte (fd=0x856c96c, flag=Variable "flag" is not available.
) at /home/sysop/php-5.1.4/ext/gd/libgd/gd_gif_in.c:394
#1  0x080ead3c in ReadImage (im=0x8569604, fd=0x856c96c, len=130, height=130, cmap=0xbfffcd80, interlace=0)
    at /home/sysop/php-5.1.4/ext/gd/libgd/gd_gif_in.c:520
#2  0x080eb008 in php_gd_gdImageCreateFromGifCtx (fd=0x856c96c) at /home/sysop/php-5.1.4/ext/gd/libgd/gd_gif_in.c:199
#3  0x080d25fb in _php_image_create_from (ht=Variable "ht" is not available.
) at /home/sysop/php-5.1.4/ext/gd/gd.c:1608
#4  0x080d281b in zif_imagecreatefromgif (ht=292440, return_value=0x4000000, return_value_ptr=0x0, this_ptr=0x0, 
    return_value_used=1) at /home/sysop/php-5.1.4/ext/gd/gd.c:1674
#5  0x0822df8c in zend_do_fcall_common_helper_SPEC (execute_data=0xbfffd510) at /home/sysop/php-5.1.4/Zend/zend_vm_execute.h:200
#6  0x0822d971 in execute (op_array=0x85674e4) at /home/sysop/php-5.1.4/Zend/zend_vm_execute.h:92
#7  0x08216252 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/sysop/php-5.1.4/Zend/zend.c:1109
#8  0x081e25d0 in php_execute_script (primary_file=0xbffffa10) at /home/sysop/php-5.1.4/main/main.c:1732
#9  0x08290111 in main (argc=2, argv=0xbffffae4) at /home/sysop/php-5.1.4/sapi/cli/php_cli.c:1092

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-07-16 10:37 UTC] pajoye@php.net 
Only for the record, the gif image is corrupt. Fix coming.
 [2006-07-16 11:10 UTC] pajoye@php.net 
Fixed in PHP_5_2. I will close the bug once I merge it in all branches.
 [2006-07-18 06:35 UTC] pajoye@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sat Dec 21 16:01:28 2024 UTC