php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #73893 A hidden danger of death cycle in a function of gd
Submitted: 2017-01-09 02:54 UTC Modified: 2017-01-10 18:21 UTC
From: swjun1128 at 126 dot com Assigned: cmb (profile)
Status: Closed Package: GD related
PHP Version: 7.0.14 OS: ALL
Private report: No CVE-ID: None
 [2017-01-09 02:54 UTC] swjun1128 at 126 dot com
Description:
------------
I find a hidden danger of death cycle in a function of gd:gdImageRotate in the file gd_rotate.c. Although from the version 5.5.0 the function is changed to another function:gdImageRotateInterpolated(not for the reason I proposed),but the original is not deleted.So,I think it is a hidden danger of death cycle.
while (dAngle >= 360.0) {
		dAngle -= 360.0;
	}
dAngle is a double.When it is assigned a large floating point number e.g:1e20,the function goes to a death cycle because 1e20-360.0=1e20!
The following script only goes wrong in the version before 5.5.0.But I still think it is a hidden danger since the function gd:gdImageRotate is not deleted.

Test script:
---------------
<?php
 // File and rotation
 $filename = 'dog.jpg';
 $angle = 2e30;
 $im = imagecreatefromjpeg($filename);
 // Content type
 header('Content-type: image/jpeg');
 
 // Load
 $source = imagecreatefromjpeg($filename);
 
 // Rotate
 $rotate = imagerotate($source, $angle, 0);
 
 // Output
 imagejpeg($rotate,'dogrotate.jpg');
 imagejpeg($source);

 ?>

Expected result:
----------------
Rotate the image with right angle.

Actual result:
--------------
death cycle

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-01-09 17:14 UTC] cmb@php.net
-Assigned To: +Assigned To: cmb
 [2017-01-10 18:21 UTC] cmb@php.net
-Type: Security +Type: Bug -PHP Version: 7.1.0 +PHP Version: 7.0.14
 [2017-01-10 18:21 UTC] cmb@php.net
Thanks for reporting the problem!

As gdImageRotate() isn't used by PHP, nor is it declared to be a
PHP_API, there is no vulnerability (besides that it might be
regarded a programming error to pass such large angles to it).

Nonetheless, I'm going to remove the unused gdImageRotate() and
gdImageRotate45() from the bundled libgd to prevent that they will
be used in the future.

They will also be removed in GD-2.2.4.
 [2017-01-10 19:03 UTC] cmb@php.net
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=15837bab8ce05ead227d654f0b7ed8f6a0a431d8
Log: Fix #73893: A hidden danger of death cycle in a function of gd
 [2017-01-10 19:03 UTC] cmb@php.net
-Status: Assigned +Status: Closed
 [2017-01-10 19:15 UTC] cmb@php.net
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=15837bab8ce05ead227d654f0b7ed8f6a0a431d8
Log: Fix #73893: A hidden danger of death cycle in a function of gd
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Mon Dec 09 18:01:27 2024 UTC