Description:
------------
output function from gd_gif_out.c causes out-of-bounds access of the masks array when ctx->cur_bits becomes a negative number.

Source code:

https://github.com/php/php-src/blob/master/ext/gd/libgd/gd_gif_out.c#L612

...
static unsigned long masks[] = { 0x0000, 0x0001, 0x0003, 0x0007, 0x000F,
                                  0x001F, 0x003F, 0x007F, 0x00FF,
                                  0x01FF, 0x03FF, 0x07FF, 0x0FFF,
                                  0x1FFF, 0x3FFF, 0x7FFF, 0xFFFF };

static void
output(code_int code, GifCtx *ctx)
{
    ctx->cur_accum &= masks[ ctx->cur_bits ];               ## Read out of bounds

    if( ctx->cur_bits > 0 )
        ctx->cur_accum |= ((long)code << ctx->cur_bits);
    else
....


According to my research on libgd, this patch from May 14 fixes this problem, but it's not applied on PHP:

https://github.com/libgd/libgd/commit/82b80dcb70a7ca8986125ff412bceddafc896842


GDB output

gdb -q --args /home/user/php/php-70/sapi/cli/php -n poc.php
No symbol table is loaded.  Use the "file" command.
Breakpoint 1 (__asan_report_error) pending.
Reading symbols from /home/user/php/php-70/sapi/cli/php...done.
gdb-peda$ b gd_gif_out.c:612 if ctx->cur_bits < 0
Breakpoint 2 at 0x818a5b5: file /home/user/php/php-70/ext/gd/libgd/gd_gif_out.c, line 612.
gdb-peda$ r
Starting program: /home/user/php/php-70/sapi/cli/php -n poc.php
GIF87add,dd,[----------------------------------registers-----------------------------------]
EAX: 0x8b47000 --> 0x8b46db8 --> 0x1
EBX: 0x0
ECX: 0x4
EDX: 0xffff2814 --> 0x64 ('d')
ESI: 0x0
EDI: 0x0
EBP: 0xffff2778 --> 0xffff27b8 --> 0xffff9eb8 --> 0xffff9f28 --> 0xffff9f98 --> 0xffff9fc8 (--> ...)
ESP: 0xffff2770 --> 0x5
EIP: 0x818a5b5 (<output+17>:    mov    edx,DWORD PTR [ebp+0xc])
EFLAGS: 0x206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x818a5a8 <output+4>:        sub    esp,0x4
   0x818a5ab <output+7>:        call   0x8076e59 <__x86.get_pc_thunk.ax>
   0x818a5b0 <output+12>:       add    eax,0x9bca50
=> 0x818a5b5 <output+17>:       mov    edx,DWORD PTR [ebp+0xc]
   0x818a5b8 <output+20>:       mov    ecx,DWORD PTR [edx+0x758c]
   0x818a5be <output+26>:       mov    edx,DWORD PTR [ebp+0xc]
   0x818a5c1 <output+29>:       mov    edx,DWORD PTR [edx+0x7590]
   0x818a5c7 <output+35>:       mov    eax,DWORD PTR [eax+edx*4+0x1e40]
[------------------------------------stack-------------------------------------]
0000| 0xffff2770 --> 0x5
0004| 0xffff2774 --> 0x0
0008| 0xffff2778 --> 0xffff27b8 --> 0xffff9eb8 --> 0xffff9f28 --> 0xffff9f98 --> 0xffff9fc8 (--> ...)
0012| 0xffff277c --> 0x818a4d9 (<compress+510>: add    esp,0x10)
0016| 0xffff2780 --> 0x0
0020| 0xffff2784 --> 0xffff2814 --> 0x64 ('d')
0024| 0xffff2788 --> 0xffff27b8 --> 0xffff9eb8 --> 0xffff9f28 --> 0xffff9f98 --> 0xffff9fc8 (--> ...)
0028| 0xffff278c --> 0x818a2e9 (<compress+14>:  add    eax,0x9bcd17)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value

Breakpoint 2, output (code=0x0, ctx=0xffff2814) at /home/user/php/php-70/ext/gd/libgd/gd_gif_out.c:612
612         ctx->cur_accum &= masks[ ctx->cur_bits ];
gdb-peda$ p ctx->cur_bits
$1 = 0xfffffffe                      ##  Out of bounds (negative value)


Test script:
---------------
<?php

$img = imagecreate(100, 100);
imagesetpixel($img, 0, 0, 5);
imagegif($img);


Expected result:
----------------
Valid gif file.

Actual result:
--------------
/ram/php-fuzz/phuzzer/php-70/sapi/cli/php -n poc.php


==8404==ERROR: AddressSanitizer: global-buffer-overflow on address 0x09f942f8 at pc 0x08663b24 bp 0xffbcb248 sp 0xffbcb238
READ of size 4 at 0x09f942f8 thread T0
    #0 0x8663b23 in output /home/user/php/php-70-asan/ext/gd/libgd/gd_gif_out.c:612
    #1 0x8664ca2 in compress /home/user/php/php-70-asan/ext/gd/libgd/gd_gif_out.c:566
    #2 0x8664ca2 in GIFEncode /home/user/php/php-70-asan/ext/gd/libgd/gd_gif_out.c:397
    #3 0x8668380 in php_gd_gdImageGifCtx /home/user/php/php-70-asan/ext/gd/libgd/gd_gif_out.c:134
    #4 0x85d3137 in _php_image_output_ctx /home/user/php/php-70-asan/ext/gd/gd_ctx.c:195
    #5 0x85d3137 in zif_imagegif /home/user/php/php-70-asan/ext/gd/gd.c:2662
    #6 0x9a388ac in ZEND_DO_ICALL_SPEC_HANDLER /home/user/php/php-70-asan/Zend/zend_vm_execute.h:586
    #7 0x980d06f in execute_ex /home/user/php/php-70-asan/Zend/zend_vm_execute.h:414
    #8 0x9b287c5 in zend_execute /home/user/php/php-70-asan/Zend/zend_vm_execute.h:458
    #9 0x95e4c3c in zend_execute_scripts /home/user/php/php-70-asan/Zend/zend.c:1427
    #10 0x932d58b in php_execute_script /home/user/php/php-70-asan/main/main.c:2494
    #11 0x9b31004 in do_cli /home/user/php/php-70-asan/sapi/cli/php_cli.c:974
    #12 0x80a6e78 in main /home/user/php/php-70-asan/sapi/cli/php_cli.c:1344
    #13 0xf6c9e636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636)
    #14 0x80a755a  (/ram/php-fuzz/phuzzer/php-70-asan/sapi/cli/php+0x80a755a)

0x09f942f8 is located 49 bytes to the right of global variable '*.LC3' defined in '/home/user/php/php-70-asan/ext/gd/libgd/gd_gif_out.c' (0x9f942c0) of size 7
  '*.LC3' is ascii string 'GIF89a'
0x09f942f8 is located 8 bytes to the left of global variable 'masks' defined in '/home/user/php/php-70-asan/ext/gd/libgd/gd_gif_out.c:604:22' (0x9f94300) of size 68
SUMMARY: AddressSanitizer: global-buffer-overflow /home/user/php/php-70-asan/ext/gd/libgd/gd_gif_out.c:612 output