|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2019-05-05 10:29 UTC] chamal dot desilva at gmail dot com
Description:
------------
Versions
--------
PHP 8.0.0-dev - Latest code
PHP 7.3.5 - Stable
Configure Line
--------------
Latest Code from Git-
./configure --prefix=/dir_name/install --enable-gd --enable-cli --enable-debug --without-pear
PHP stable version 7.3.5 -
./configure --prefix=/dir_name/install --with-gd --enable-cli --enable-debug --without-pear
Reproduce Steps
---------------
1. Save test script as xbm.php
Then execute these commands.
2. export ZEND_DONT_UNLOAD_MODULES=1
3. export USE_ZEND_ALLOC=0
4. valgrind ./php xbm.php
Test script:
---------------
<?php
$contents = hex2bin("23646566696e6520776964746820320a23646566696e652068656967687420320a737461746963206368617220626974735b5d203d7b0a7a7a787a7a");
$filepath = dirname(__FILE__).DIRECTORY_SEPARATOR."test.xbm";
file_put_contents($filepath, $contents);
$xbm = imagecreatefromxbm($filepath);
?>
Actual result:
--------------
Valgrind
--------
Line numbers are from PHP version 7.3.5
==27902== Conditional jump or move depends on uninitialised value(s)
==27902== at 0x4B12F5: php_gd_gdImageSetPixel (gd.c:766)
==27902== by 0x4C45C4: php_gd_gdImageCreateFromXbm (gd_xbm.c:141)
==27902== by 0x4A845F: _php_image_create_from (gd.c:2463)
==27902== by 0x4A85E5: zif_imagecreatefromxbm (gd.c:2527)
==27902== by 0x80E61C: ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:690)
==27902== by 0x87BA0F: execute_ex (zend_vm_execute.h:55465)
==27902== by 0x88107D: zend_execute (zend_vm_execute.h:60881)
==27902== by 0x7A599E: zend_execute_scripts (zend.c:1568)
==27902== by 0x70B0C3: php_execute_script (main.c:2630)
==27902== by 0x883DD2: do_cli (php_cli.c:997)
==27902== by 0x884F49: main (php_cli.c:1389)
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Tue Oct 28 02:00:01 2025 UTC |
Cause of Bug ------------- Description ------------ This bug is present in gdImageCreateFromXbm method of ext/gd/libgd/gd_xbm.c file. This method contains below mentioned lines. ... unsigned int b; ... sscanf(h, "%x", &b); for (bit = 1; bit <= max_bit; bit = bit << 1) { gdImageSetPixel(im, x++, y, (b & bit) ? 1 : 0); ... So when sscanf method is not able to read a hex value, "b" variable will contain uninitialized data.