|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2012-07-10 13:55 UTC] romans dot heimanis at gmail dot com
Description:
------------
i got the jpeg file which is crashing our production server when exif_read_data
is called. I have testet with latest 5.3 snapshot, same there. Same results for
5.2 version, same results with 32 or 64bit versions.
Test script:
---------------
<?php
exif_read_data("1.orig.jpg");
?>
Expected result:
----------------
return the array of exif data
Actual result:
--------------
Reading symbols from /usr/bin/php...(no debugging symbols found)...done.
[New LWP 27266]
warning: Can't read pathname for load map: Input/output error.
[Thread debugging using libthread_db enabled]
Core was generated by `php filed.php'.
Program terminated with signal 11, Segmentation fault.
#0 0x080e5046 in ?? ()
(gdb) bt
#0 0x080e5046 in ?? ()
#1 0x080e561d in ?? ()
#2 0x080e60b3 in ?? ()
#3 0x080e6bbe in ?? ()
#4 0x080e70ef in ?? ()
#5 0x080e6e00 in ?? ()
#6 0x080e70ef in ?? ()
#7 0x080e906c in ?? ()
#8 0x080e92c2 in ?? ()
#9 0x083985ca in ?? ()
#10 0x0834344e in execute ()
#11 0x0831c199 in zend_execute_scripts ()
#12 0x082c2dce in php_execute_script ()
#13 0x0806b47f in ?? ()
#14 0x0077c113 in __libc_start_main () from /lib/i386-linux-gnu/libc.so.6
#15 0x0806b521 in _start ()
Shoid i build php with debug symbols?
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Tue Dec 03 17:01:29 2024 UTC |
I can reproduce this only in 5.3, seems 5.3 and 5.4 have the same exif code, but can not reproduce this in 5.4. #0 0x00002b6649bdd8fe in php_ifd_get16u (value=0xffffffffcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1095 1095 return (((uchar *)value)[1] << 8) | ((uchar *)value)[0]; (gdb) bt #0 0x00002b6649bdd8fe in php_ifd_get16u (value=0xffffffffcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1095 #1 0x00002b6649bdeba8 in exif_iif_add_value (image_info=0x7fff7b6ec450, section_index=13, name=0x7fff7b6ebbb0 "CustomFunctions", tag=15, format=3, length=12, value=0xffffffffcc675e60, motorola_intel=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1762 #2 0x00002b6649bded63 in exif_iif_add_tag (image_info=0x7fff7b6ec450, section_index=13, name=0x7fff7b6ebbb0 "CustomFunctions", tag=15, format=3, length=12, value=0xffffffffcc675e60) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1812 #3 0x00002b6649be23e3 in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb512d8 "\017", offset_base=0xffffffffcc67493c <Address 0xffffffffcc67493c out of bounds>, IFDlength=13482, displacement=30, section_index=13, ReadNextIFD=0, tag_table=0x2b6649de9b00) at /home/huixinchen/opensource/php- 5.3/ext/exif/exif.c:3135 #4 0x00002b6649be123b in exif_process_IFD_in_MAKERNOTE (ImageInfo=0x7fff7b6ec450, value_ptr=0x1eb512ca "\027", value_len=3476, offset_base=0xffffffffcc67493c <Address 0xffffffffcc67493c out of bounds>, IFDlength=13482, displacement=30) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:2813 #5 0x00002b6649be221f in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb5085c "|\222\a", offset_base=0x1eb4fec0 "II*", IFDlength=13482, displacement=30, section_index=7, ReadNextIFD=1, tag_table=0x2b6649de88e0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3089 #6 0x00002b6649be256f in exif_process_IFD_in_JPEG (ImageInfo=0x7fff7b6ec450, dir_start=0x1eb507b2 "\037", offset_base=0x1eb4fec0 "II*", IFDlength=13482, displacement=30, section_index=7) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3163 #7 0x00002b6649be2385 in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450, dir_entry=0x1eb4ff36 "i\207\004", offset_base=0x1eb4fec0 "II*", IFDlength=13482, displacement=30, section_index=3, ReadNextIFD=1, tag_table=0x2b6649de88e0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3126 #8 0x00002b6649be256f in exif_process_IFD_in_JPEG (ImageInfo=0x7fff7b6ec450, dir_start=0x1eb4fec8 "\v", offset_base=0x1eb4fec0 "II*", IFDlength=13482, displacement=30, section_index=3) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3163 #9 0x00002b6649be285a in exif_process_TIFF_in_JPEG (ImageInfo=0x7fff7b6ec450, CharBuf=0x1eb4fec0 "II*", length=13482, displacement=30) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3240 #10 0x00002b6649be298c in exif_process_APP1 (ImageInfo=0x7fff7b6ec450, CharBuf=0x1eb4feb8 "4²Exif", length=13490, displacement=22) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3265 #11 0x00002b6649be2f1d in exif_scan_JPEG_header (ImageInfo=0x7fff7b6ec450) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3410 #12 0x00002b6649be3ffd in exif_scan_FILE_header (ImageInfo=0x7fff7b6ec450) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3792 #13 0x00002b6649be4c41 in exif_read_file (ImageInfo=0x7fff7b6ec450, FileName=0x1eb4b8e8 "/tmp/1.orig.jpg", read_thumbnail=0, read_all=0) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3931 #14 0x00002b6649be4e27 in zif_exif_read_data (ht=1, return_value=0x1eb4aac0, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1) at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3984 #15 0x00000000008e7d95 in zend_do_fcall_common_helper_SPEC (execute_data=0x2b664a23b090) at /home/huixinchen/opensource/php-5.3/Zend/zend_vm_execute.h:320 #16 0x00000000008ed77c in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0x2b664a23b090) at /home/huixinchen/opensource/php-5.3/Zend/zend_vm_execute.h:1640 ---Type <return> to continue, or q <return> to quit---I encountered a similar issue reading EXIF from a TIFF, the below patch fixes both my original TIFF issue, and the issue with file "1.orig.jpg" linked in the original report for me. Environment: Linux amd64/i686 (Debian 5/6/7, Ubuntu 13.04) PHP version: 5.3.25 SAPI: CLI/FastCGI Required for the JPEG fix is a change from int type for offset_diff in exif_process_IFD_in_MAKERNOTE. I've changed it to size_t, which is semantically correct for Linux, but I think this isn't portable to Win. Essentially, the issue is that values read from the file are treated as offsets, and used to manipulate the offset_base. Patch (agains 5.3.25) follows: diff -rupN php-5.3.25.orig/ext/exif/exif.c php-5.3.25/ext/exif/exif.c --- php-5.3.25.orig/ext/exif/exif.c 2013-05-08 16:58:52.000000000 +0100 +++ php-5.3.25/ext/exif/exif.c 2013-05-21 14:59:59.579438565 +0100 @@ -2745,7 +2745,8 @@ static int exif_process_unicode(image_in static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * value_ptr, int value_len, char *offset_base, size_t IFDlength, size_t displacement TSRMLS_DC) { int de, i=0, section_index = SECTION_MAKERNOTE; - int NumDirEntries, old_motorola_intel, offset_diff; + int NumDirEntries, old_motorola_intel; + size_t offset_diff; const maker_note_type *maker_note; char *dir_start; @@ -2921,6 +2922,12 @@ static int exif_process_IFD_TAG(image_in } } } else { + if (value_ptr<offset_base) { +#ifdef EXIF_DEBUG + exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "EXIF invalid: offset_base (x%016llX) exceed value_ptr (x%016llX)", offset_base, value_ptr); +#endif + return FALSE; + } /* 4 bytes or less and value is in the dir entry itself */ value_ptr = dir_entry+8; offset_val= value_ptr-offset_base; @@ -3724,6 +3731,12 @@ static int exif_process_IFD_in_TIFF(imag exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Next IFD: %s done", exif_get_sectionname(sub_section_index)); #endif } else { + if(dir_offset > ImageInfo->file.list[sn].data) { +#ifdef EXIF_DEBUG + exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Skip processing: dir_offset (x%016llX) exceeds data pointer (x%016llX)", ImageInfo->file.list[sn].data, dir_offset); +#endif + return FALSE; + } if (!exif_process_IFD_TAG(ImageInfo, (char*)dir_entry, (char*)(ImageInfo->file.list[sn].data-dir_offset), ifd_size, 0, section_index, 0, tag_table TSRMLS_CC)) {To expand on my last comment, the patch from Dominic fixed the SegFault, but caused other issues with reading the majority of the exif data. I was no longer able to read other meta-data including Orientation, and had to revert. Here are some of the details from my setup: CentOS 5.9 x86_64 PHP 5.5.4 - File - <? $array = exif_read_data('file.jpg'); print_r($array); exit; ?> - Output - php test.php PHP Warning: exif_read_data(file.jpg): Incorrect APP1 Exif Identifier Code in /home/xoticspottest/site/test.php on line 2 Segmentation fault - Strace php test.php - ... read(3, "\377\330\377\340\0\20JFIF\0\1\1\1\0H\0H\0\0\377\341\v\273http://n"..., 8192) = 8192 write(2, "PHP Warning: exif_read_data(101"..., 140PHP Warning: exif_read_data(file.jpg): Incorrect APP1 Exif Identifier Code in /home/xoticspottest/site/test.php on line 2) = 140 read(3, "\0^\17\0\0\230\0\3\0\4\0\0\0^\23\0\0\231\0\4\0J\0\0\0f\23\0\0\232\0\4"..., 8192) = 8192 read(3, "\1\3\21\1\377\304\0\37\0\0\1\5\1\1\1\1\1\1\0\0\0\0\0\0\0\0\1\2\3\4\5\6"..., 8192) = 8192 mmap(NULL, 266240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acd7c444000 mmap(NULL, 266240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acd7c485000 close(3) = 0 mmap(NULL, 266240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acd7c4c6000 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ If needed, email me for the sample jpg. I can't put it on a public URL due to licensing issues.After trying to assist someone with this issue on their setup I decided to test it some on mine since the reports of it's existence are pretty varied. Out of four images tested (one the person provided, and the three linked here), only ONE of the images actually caused a segfault on both of my two tested setups, and that was the bad_exif.jpeg file. My two setups are a 5.4.14 source-compiled on a 32-bit Fedora 17, and a 5.4.20 source-compiled on a 64-bit Fedora 19, and as noted above none of the images EXCEPT the bad_exif.jpeg cause segfaults under either web access (lighttpd+php-fpm setup) or CLI called. Rebuilt the 5.4.14 setup into debug to get the following; (gdb) bt #0 0x0831ecfc in mbfl_buffer_converter_new2 (from=0x8a4f790, to=0x0, buf_initsz=38) at /root/apps/php-5.4.14/ext/mbstring/libmbfl/mbfl/mbfilter.c:158 #1 0x08326684 in php_mb_zend_encoding_converter (to=0xbfffbeec, to_length=0xbfffb9c4, from=0xb765aa1e "", from_length=38, encoding_to=0x0, encoding_from=0x8a4f790) at /root/apps/php-5.4.14/ext/mbstring/mbstring.c:917 #2 0x0861feeb in zend_multibyte_encoding_converter (to=0xbfffbeec, to_length=0xbfffb9c4, from=0xb765aa1e "", from_length=38, encoding_to=0x0, encoding_from=0x8a4f790) at /root/apps/php-5.4.14/Zend/zend_multibyte.c:150 #3 0x082264ba in exif_process_user_comment (ImageInfo=0xbfffbe98, pszInfoPtr=0xbfffbeec, pszEncoding=0xbfffbef4, szValuePtr=0xb765aa1e "", ByteCount=38) at /root/apps/php-5.4.14/ext/exif/exif.c:2666 #4 0x08227270 in exif_process_IFD_TAG (ImageInfo=0xbfffbe98, dir_entry=0xb765a93a "\206\222\a", offset_base=0xb765a780 "II*", IFDlength=24564, displacement=12, section_index=7, ReadNextIFD=1, tag_table=0x8747f60) at /root/apps/php-5.4.14/ext/exif/exif.c:2972 #5 0x08227953 in exif_process_IFD_in_JPEG (ImageInfo=0xbfffbe98, dir_start=0xb765a86c "\031", offset_base=0xb765a780 "II*", IFDlength=24564, displacement=12, section_index=7) at /root/apps/php-5.4.14/ext/exif/exif.c:3138 #6 0x0822776f in exif_process_IFD_TAG (ImageInfo=0xbfffbe98, dir_entry=0xb765a7f6 "i\207\004", offset_base=0xb765a780 "II*", IFDlength=24564, displacement=12, section_index=3, ReadNextIFD=1, tag_table=0x8747f60) at /root/apps/php-5.4.14/ext/exif/exif.c:3101 #7 0x08227953 in exif_process_IFD_in_JPEG (ImageInfo=0xbfffbe98, dir_start=0xb765a788 "\n", offset_base=0xb765a780 "II*", IFDlength=24564, displacement=12, section_index=3) at /root/apps/php-5.4.14/ext/exif/exif.c:3138 #8 0x08227c06 in exif_process_TIFF_in_JPEG (ImageInfo=0xbfffbe98, CharBuf=0xb765a780 "II*", length=24564, displacement=12) at /root/apps/php-5.4.14/ext/exif/exif.c:3215 #9 0x08227ccc in exif_process_APP1 (ImageInfo=0xbfffbe98, CharBuf=0xb765a778 "_\374Exif", length=24572, displacement=4) at /root/apps/php-5.4.14/ext/exif/exif.c:3240 #10 0x08228235 in exif_scan_JPEG_header (ImageInfo=0xbfffbe98) at /root/apps/php-5.4.14/ext/exif/exif.c:3385 #11 0x0822906e in exif_scan_FILE_header (ImageInfo=0xbfffbe98) at /root/apps/php-5.4.14/ext/exif/exif.c:3767 #12 0x08229bd8 in exif_read_file (ImageInfo=0xbfffbe98, FileName=0xb756af78 "/home/www/sites/bad_exif.jpeg", read_thumbnail=0, read_all=0) at /root/apps/php-5.4.14/ext/exif/exif.c:3906 #13 0x08229db4 in zif_exif_read_data (ht=1, return_value=0xb7656d08, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1) at /root/apps/php-5.4.14/ext/exif/exif.c:3959 #14 0x0863a1d6 in zend_do_fcall_common_helper_SPEC (execute_data=0xb763c074) at /root/apps/php-5.4.14/Zend/zend_vm_execute.h:643 #15 0x0863db9d in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0xb763c074) at /root/apps/php-5.4.14/Zend/zend_vm_execute.h:2225 #16 0x086398bf in execute (op_array=0xb76574e8) at /root/apps/php-5.4.14/Zend/zend_vm_execute.h:410 #17 0x0860708e in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/apps/php-5.4.14/Zend/zend.c:1315 #18 0x085910cf in php_execute_script (primary_file=0xbffff434) at /root/apps/php-5.4.14/main/main.c:2492 #19 0x08698b2b in do_cli (argc=2, argv=0xbffff6a4) at /root/apps/php-5.4.14/sapi/cli/php_cli.c:988 #20 0x08699c01 in main (argc=2, argv=0xbffff6a4) at /root/apps/php-5.4.14/sapi/cli/php_cli.c:1364$ uname -a Linux grevus 4.2.5-1-ARCH #1 SMP PREEMPT Tue Oct 27 08:13:28 CET 2015 x86_64 GNU/Linux $ php -v PHP 5.6.15 (cli) (built: Nov 10 2015 20:22:58) Copyright (c) 1997-2015 The PHP Group Zend Engine v2.6.0, Copyright (c) 1998-2015 Zend Technologies $ cat test.php && echo "" && php test.php <?php exif_read_data('http://dl.dropbox.com/u/7562584/Bugs/Php/bad_exif.jpeg'); Segmentation fault (core dumped) ===================== Still existsI can very much reproduce this too with 5.6. It looks like "encoding_to=0x0" in frame 2 is the problem. Backtrace: 158 if (mbfl_convert_filter_get_vtbl(convd->from->no_encoding, convd->to->no_encoding) != NULL) { (gdb) bt full #0 0x000000000074bdd9 in mbfl_buffer_converter_new2 (from=0x1387300 <mbfl_encoding_jis>, to=0x0, buf_initsz=38) at /home/derick/dev/php/php-src.git/ext/mbstring/libmbfl/mbfl/mbfilter.c:158 convd = 0x7fffe948cfa0 #1 0x0000000000754ca0 in php_mb_zend_encoding_converter (to=0x7fffffffc668, to_length=0x7fffffffc038, from=0x7fffe948f32e "", from_length=38, encoding_to=0x0, encoding_from=0x1387300 <mbfl_encoding_jis>) at /home/derick/dev/php/php-src.git/ext/mbstring/mbstring.c:945 string = {no_language = mbfl_no_language_neutral, no_encoding = mbfl_no_encoding_jis, val = 0x7fffe948f32e "", len = 38} result = {no_language = mbfl_no_language_uni, no_encoding = mbfl_no_encoding_pass, val = 0x0, len = 0} convd = 0x5800000001 status = 0 loc = 0 #2 0x0000000000ab6e3f in zend_multibyte_encoding_converter (to=0x7fffffffc668, to_length=0x7fffffffc038, from=0x7fffe948f32e "", from_length=38, encoding_to=0x0, encoding_from=0x1387300 <mbfl_encoding_jis>) at /home/derick/dev/php/php-src.git/Zend/zend_multibyte.c:150 No locals. #3 0x0000000000635c9b in exif_process_user_comment (ImageInfo=0x7fffffffc5f0, pszInfoPtr=0x7fffffffc668, pszEncoding=0x7fffffffc678, szValuePtr=0x7fffe948f32e "", ByteCount=38) at /home/derick/dev/php/php-src.git/ext/exif/exif.c:2658 a = 0 decode = 0x7fffffffc060 "\200\301\377\377\377\177" len = 140737107259986 #4 0x0000000000636c54 in exif_process_IFD_TAG (ImageInfo=0x7fffffffc5f0, dir_entry=0x7fffe948f24a "\206\222\a", offset_base=0x7fffe948f090 "II*", IFDlength=24564, displacement=12, section_index=7, ReadNextIFD=1, tag_table=0x13777a0 <tag_table_IFD>) at /home/derick/dev/php/php-src.git/ext/exif/exif.c:2969 length = 140737107285952 tag = 37510 format = 7 components = 46 value_ptr = 0x7fffe948f326 "JIS" tagname = "FocalLength\000\000ce\000\000\000ixel\000\000$\371\245\000\000\000\000\000 \301\377\377\377\177\000\000N\370\245", '\000' <repeats 13 times>, "Ps\305\000\000\000\000" cbuf = "\320\300\377\377\377\177\000\000\230\363\245", '\000' <repeats 17 times>, "\232\006\000" outside = 0x0 byte_count = 46 offset_val = 662 fpos = 6502854 fgot = 140737488339328 byte_count_signed = 46 tmp_xp = 0x7fffe948f16c$ uname -a Linux grevus 4.6.4-1-ARCH #1 SMP PREEMPT Mon Jul 11 19:12:32 CEST 2016 x86_64 GNU/Linux $ php -v PHP 7.0.8 (cli) (built: Jun 22 2016 16:45:35) ( NTS ) Copyright (c) 1997-2016 The PHP Group Zend Engine v3.0.0, Copyright (c) 1998-2016 Zend Technologies $ cat test.php && echo "" && php test.php <?php exif_read_data('http://dl.dropbox.com/u/7562584/Bugs/Php/bad_exif.jpeg'); Segmentation fault (core dumped)<?php exif_read_data('http://dl.dropbox.com/u/7562584/Bugs/Php/bad_exif.jpeg'); Indeed, valgrind reports | Conditional jump or move depends on uninitialised value(s) In this case cert_captured is uninitialized in the check whether peer_cert has to be freed[1]. After adding a proper initializer, there are still memory leaks reported by valgrind (also when file_get_contents() is used instead of exif_read_data() with the unmodified C code). Stas, could you have a look at this issue? [1] <https://github.com/php/php-src/blob/PHP-7.0.9/ext/openssl/xp_ssl.c#L1893>