My Alpine packages repository.
https://dryabzhinsky.noip.me/packages/en/alpinelinux-support/
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
72 lines
3.0 KiB
72 lines
3.0 KiB
From 41131cd41d2fd2e0c2f332a27988df75659c42e4 Mon Sep 17 00:00:00 2001 |
|
From: Stanislav Malyshev <stas@php.net> |
|
Date: Mon, 18 Jul 2016 23:21:51 -0700 |
|
Subject: [PATCH] Fix bug #72618: NULL Pointer Dereference in |
|
exif_process_user_comment |
|
|
|
Index: php5-5.4.45/ext/exif/exif.c |
|
=================================================================== |
|
--- php5-5.4.45.orig/ext/exif/exif.c 2016-08-28 11:34:41.000000000 +0200 |
|
+++ php5-5.4.45/ext/exif/exif.c 2016-08-28 11:34:41.000000000 +0200 |
|
@@ -2623,6 +2623,7 @@ |
|
*pszEncoding = NULL; |
|
/* Copy the comment */ |
|
if (ByteCount>=8) { |
|
+ const zend_encoding *from, *to; |
|
if (!memcmp(szValuePtr, "UNICODE\0", 8)) { |
|
*pszEncoding = estrdup((const char*)szValuePtr); |
|
szValuePtr = szValuePtr+8; |
|
@@ -2643,14 +2644,16 @@ |
|
} else { |
|
decode = ImageInfo->decode_unicode_le; |
|
} |
|
+ to = zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC); |
|
+ from = zend_multibyte_fetch_encoding(decode TSRMLS_CC); |
|
/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX */ |
|
- if (zend_multibyte_encoding_converter( |
|
+ if (!to || !from || zend_multibyte_encoding_converter( |
|
(unsigned char**)pszInfoPtr, |
|
&len, |
|
(unsigned char*)szValuePtr, |
|
ByteCount, |
|
- zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC), |
|
- zend_multibyte_fetch_encoding(decode TSRMLS_CC) |
|
+ to, |
|
+ from |
|
TSRMLS_CC) == (size_t)-1) { |
|
len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount); |
|
} |
|
@@ -2665,13 +2668,15 @@ |
|
szValuePtr = szValuePtr+8; |
|
ByteCount -= 8; |
|
/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX */ |
|
- if (zend_multibyte_encoding_converter( |
|
+ to = zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC); |
|
+ from = zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le TSRMLS_CC); |
|
+ if (!to || !from || zend_multibyte_encoding_converter( |
|
(unsigned char**)pszInfoPtr, |
|
&len, |
|
(unsigned char*)szValuePtr, |
|
ByteCount, |
|
- zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC), |
|
- zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le TSRMLS_CC) |
|
+ to, |
|
+ from |
|
TSRMLS_CC) == (size_t)-1) { |
|
len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount); |
|
} |
|
Index: php5-5.4.45/ext/xmlrpc/libxmlrpc/simplestring.c |
|
=================================================================== |
|
--- php5-5.4.45.orig/ext/xmlrpc/libxmlrpc/simplestring.c 2016-08-28 11:34:40.000000000 +0200 |
|
+++ php5-5.4.45/ext/xmlrpc/libxmlrpc/simplestring.c 2016-08-28 11:35:30.000000000 +0200 |
|
@@ -197,6 +197,10 @@ |
|
simplestring_init_str(target); |
|
} |
|
|
|
+#ifndef SIZE_MAX |
|
+# define SIZE_MAX ((size_t) -1) |
|
+#endif |
|
+ |
|
if((SIZE_MAX - add_len) < target->len || (SIZE_MAX - add_len - 1) < target->len) { |
|
/* check for overflows, if there's a potential overflow do nothing */ |
|
return;
|
|
|