Patch fix-75571 for GD related Bug #75571

Patch version 2017-11-29 18:54 UTC

• 2017-11-29 18:54 UTC [diff to current]

Developer: cmb@php.net

From db339e56610a1b65d54576afc55ca0d809556760 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Wed, 29 Nov 2017 18:52:33 +0100
Subject: [PATCH] Fixed bug #75571: Potential infinite loop in
 gdImageCreateFromGifCtx

Due to a signedness confusion in `GetCode_` a corrupt GIF file can
trigger an infinite loop.  Furthermore we make sure that a GIF without
any palette entries is treated as invalid *after* open palette entries
have been removed.
---
 ext/gd/libgd/gd_gif_in.c   |  10 +++++-----
 ext/gd/tests/bug75571.gif  | Bin 0 -> 1731 bytes
 ext/gd/tests/bug75571.phpt |  15 +++++++++++++++
 3 files changed, 20 insertions(+), 5 deletions(-)
 create mode 100644 ext/gd/tests/bug75571.gif
 create mode 100644 ext/gd/tests/bug75571.phpt

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index 262350ef44..8b2a1b42fa 100644
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -262,10 +262,6 @@ terminated:
 	if (!im) {
 		return 0;
 	}
-	if (!im->colorsTotal) {
-		gdImageDestroy(im);
-		return 0;
-	}
 	/* Check for open colors at the end, so
 	   we can reduce colorsTotal and ultimately
 	   BitsPerPixel */
@@ -276,6 +272,10 @@ terminated:
 			break;
 		}
 	}
+	if (!im->colorsTotal) {
+		gdImageDestroy(im);
+		return 0;
+	}
 	return im;
 }
 /* }}} */
@@ -376,7 +376,7 @@ static int
 GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP)
 {
 	int           i, j, ret;
-	unsigned char count;
+	int           count;
 
 	if (flag) {
 		scd->curbit = 0;
diff --git a/ext/gd/tests/bug75571.gif b/ext/gd/tests/bug75571.gif
new file mode 100644
index 0000000000000000000000000000000000000000..3c30b40f281be89217f3246d16174530c785f23e
GIT binary patch
literal 1731
zcmZ?wbhEHbbTDW#m}p>HV_;yQqz5Dn3>1H|FajwC9Rmgf1_vPYVE*4R3PwX<Gz3ON
NU^E0qLtyZP006ohigy42

literal 0
HcmV?d00001

diff --git a/ext/gd/tests/bug75571.phpt b/ext/gd/tests/bug75571.phpt
new file mode 100644
index 0000000000..5bd26b84ec
--- /dev/null
+++ b/ext/gd/tests/bug75571.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #75571 (Infinite loop in GIF reading causing DoS)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefromgif(__DIR__ . '/bug75571.gif'));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgif(): '%s' is not a valid GIF file in %s on line %d
+bool(false)
+===DONE===
-- 
2.14.1.windows.1