php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #67024 getimagesize should recognize BMP files with negative height
Submitted: 2014-04-04 22:14 UTC Modified: -
Votes:1
Avg. Score:2.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: gbuella at gmail dot com Assigned:
Status: Closed Package: GetImageSize related
PHP Version: master-Git-2014-04-04 (Git) OS:
Private report: No CVE-ID:
 [2014-04-04 22:14 UTC] gbuella at gmail dot com
Description:
------------
The functions getimagesize, and getimagesizefromstring treat the height field of a BITMAPINFOHEADER header as an unsigned integer, while it really is a signed integer. On platforms with 64 bit PHP integers, this results in height being reported as 4294966272 for an image with height -1024, instead of the expected result height=1024.

Test script:
---------------
<?php
$image_data = "Qk06AAAAAAAAADYAAAAoAAAAAQAAAP////8BABgAAAAAAAQAAADDDgAAww4AAAAAAAAAAAAA////AA==";
var_dump(getimagesizefromstring(base64_decode($image_data)));
?>

Expected result:
----------------
array(6) {
  [0]=>
  int(1)
  [1]=>
  int(1)
  [2]=>
  int(6)
  [3]=>
  string(20) "width="1" height="1""
  ["bits"]=>
  int(24)
  ["mime"]=>
  string(14) "image/x-ms-bmp"
}

Actual result:
--------------
array(6) {
  [0]=>
  int(1)
  [1]=>
  int(4294967295)
  [2]=>
  int(6)
  [3]=>
  string(21) "width="1" height="-1""
  ["bits"]=>
  int(24)
  ["mime"]=>
  string(14) "image/x-ms-bmp"
}

Patches

Add a Patch

Pull Requests

Pull requests:

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2014-04-13 22:27 UTC] stas@php.net
Automatic comment on behalf of gbuella@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=1010200da5da81642bec89d9c90d001478e3554d
Log: Fixed bug #67024 - getimagesize should recognize BMP files with negative height
 [2014-04-13 22:27 UTC] stas@php.net
-Status: Open +Status: Closed
 [2014-04-13 22:41 UTC] stas@php.net
Automatic comment on behalf of gbuella@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=1010200da5da81642bec89d9c90d001478e3554d
Log: Fixed bug #67024 - getimagesize should recognize BMP files with negative height
 [2014-04-15 12:04 UTC] ab@php.net
Automatic comment on behalf of gbuella@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=1010200da5da81642bec89d9c90d001478e3554d
Log: Fixed bug #67024 - getimagesize should recognize BMP files with negative height
 [2014-04-15 13:05 UTC] ab@php.net
Automatic comment on behalf of gbuella@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=1010200da5da81642bec89d9c90d001478e3554d
Log: Fixed bug #67024 - getimagesize should recognize BMP files with negative height
 [2014-05-01 14:59 UTC] tyrael@php.net
Automatic comment on behalf of gbuella@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=1010200da5da81642bec89d9c90d001478e3554d
Log: Fixed bug #67024 - getimagesize should recognize BMP files with negative height
 [2014-10-07 23:15 UTC] stas@php.net
Automatic comment on behalf of gbuella@gmail.com
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=1010200da5da81642bec89d9c90d001478e3554d
Log: Fixed bug #67024 - getimagesize should recognize BMP files with negative height
 [2014-10-07 23:26 UTC] stas@php.net
Automatic comment on behalf of gbuella@gmail.com
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=1010200da5da81642bec89d9c90d001478e3554d
Log: Fixed bug #67024 - getimagesize should recognize BMP files with negative height
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Sun Feb 26 14:01:37 2017 UTC