File tree Expand file tree Collapse file tree 2 files changed +23
-1
lines changed Expand file tree Collapse file tree 2 files changed +23
-1
lines changed Original file line number Diff line number Diff line change @@ -3,7 +3,29 @@ Bug #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow
3
3
--SKIPIF--
4
4
<?php if (!function_exists ("imagecreatefromgd2 " )) print "skip " ; ?>
5
5
--FILE--
6
- <?php imagecreatefromgd2 (dirname (__FILE__ ) . DIRECTORY_SEPARATOR . "bug72339.gd " ); ?>
6
+ <?php
7
+ $ fname = dirname (__FILE__ ) . DIRECTORY_SEPARATOR . "bug72339.gd " ;
8
+
9
+ $ fh = fopen ($ fname , "w " );
10
+ fwrite ($ fh , "gd2 \x00" );
11
+ fwrite ($ fh , pack ("n " , 2 ));
12
+ fwrite ($ fh , pack ("n " , 1 ));
13
+ fwrite ($ fh , pack ("n " , 1 ));
14
+ fwrite ($ fh , pack ("n " , 0x40 ));
15
+ fwrite ($ fh , pack ("n " , 2 ));
16
+ fwrite ($ fh , pack ("n " , 0x5AA0 )); // Chunks Wide
17
+ fwrite ($ fh , pack ("n " , 0x5B00 )); // Chunks Vertically
18
+ fwrite ($ fh , str_repeat ("\x41\x41\x41\x41" , 0x1000000 )); // overflow data
19
+ fclose ($ fh );
20
+
21
+ $ im = imagecreatefromgd2 ($ fname );
22
+
23
+ if ($ im ) {
24
+ imagedestroy ($ im );
25
+ }
26
+ unlink ($ fname );
27
+
28
+ ?>
7
29
--EXPECTF--
8
30
Warning: imagecreatefromgd2(): gd warning: product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
9
31
in %sbug72339.php on line %d
You can’t perform that action at this time.
0 commit comments