heap buffer overflow in gd.c

未關閉
#19,751 2 則留言 0 個 reaction 已指派 1 人 在 GitHub 檢視

@devnexen 已經在處理了。

開始於 2025年9月7日。

評估

這個 Issue 還沒有評估資料。

描述

Bug Extension: gd Status: Verified
Description

The following code:

<?php
$v_163231 = 36;
$v_163232 = 36;
$v_163233 = imagecreate($v_163231,$v_163232,);
$v_163280 = '2.00000000000001';
$v_163235 = 150;
$v_163236 = imagecreate($v_163280,$v_163235,);
$v_163237 = 255;
$v_163238 = 255;
$v_163239 = 255;
$v_163240 = imagecolorallocate($v_163233,$v_163237,$v_163238,$v_163239,);
$v_163241 = 0;
$v_163242 = 0;
$v_163243 = 0;
$v_163244 = imagecolorallocate($v_163233,$v_163241,$v_163242,$v_163243,);
$v_163245 = 255;
$v_163246 = 255;
$v_163247 = 255;
$v_163240 = imagecolorallocate($v_163236,$v_163245,$v_163246,$v_163247,);
$v_163249 = 0;
$v_163250 = 0;
$v_163251 = 0;
$v_163244 = imagecolorallocate($v_163236,$v_163249,$v_163250,$v_163251,);
for($x = 0;$x<36;$x+=2){
for($y = 0;$y<36;$y+=2){
$v_163255 = imagesetpixel($v_163233,$x,$y,$v_163244,);
}
}
$v_163256 = imagesettile($v_163236,$v_163233,);
$v_163257 = 9;
$v_163294 = '2';
$v_163259 = 139;
$v_163260 = 139;
$v_163261 = imagerectangle($v_163236,$v_163257,$v_163294,$v_163259,$v_163260,$v_163244,);
$v_163262 = 9;
$v_163263 = 9;
$v_163264 = 139;
$v_163325 = 2;
$v_163266 = imageline($v_163236,$v_163262,$v_163263,$v_163264,$v_163325,$v_163244,);
$v_163267 = 11;
$v_163268 = 12;
$v_163269 = IMG_COLOR_TILED;
$v_163270 = imagefill($v_163236,$v_163267,$v_163268,$v_163269,);

Resulted in this output:

Deprecated: Implicit conversion from float-string "2.00000000000001" to int loses precision in /home/36a85ccbd69916da9c44.php.er on line 7
=================================================================
==70==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6120000348be at pc 0x000001598a37 bp 0x7ffc50efdf40 sp 0x7ffc50efdf38
READ of size 1 at 0x6120000348be thread T0
    #0 0x1598a36 in php_gd__gdImageFillTiled /home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:2121:24
    #1 0x1592abc in php_gd_gdImageFill /home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:1999:3
    #2 0x143c9df in zif_imagefill /home/w023dtc/nightly_php/php-src/ext/gd/gd.c:2701:2
    #3 0x5ffc69f in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:1410:2
    #4 0x5b18433 in execute_ex /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:113454:12
    #5 0x5b1a9bc in zend_execute /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:119146:2
    #6 0x689b019 in zend_execute_script /home/w023dtc/nightly_php/php-src/Zend/zend.c:1977:3
    #7 0x507d5ba in php_execute_script_ex /home/w023dtc/nightly_php/php-src/main/main.c:2608:13
    #8 0x507e6f8 in php_execute_script /home/w023dtc/nightly_php/php-src/main/main.c:2648:9
    #9 0x68aff2a in do_cli /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:952:5
    #10 0x68aa30f in main /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:1363:18
    #11 0x14b62a368d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #12 0x14b62a368e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #13 0x6061f4 in _start (/home/php+0x6061f4)

0x6120000348be is located 1362 bytes to the right of 300-byte region [0x612000034240,0x61200003436c)
allocated by thread T0 here:
    #0 0x6810bd in malloc (/home/php+0x6810bd)
    #1 0x56f1d03 in __zend_malloc /home/w023dtc/nightly_php/php-src/Zend/zend_alloc.c:3543:14
    #2 0x56f0469 in _emalloc /home/w023dtc/nightly_php/php-src/Zend/zend_alloc.c:2780:10
    #3 0x56f1f2b in _ecalloc /home/w023dtc/nightly_php/php-src/Zend/zend_alloc.c:2847:6
    #4 0x159726f in php_gd__gdImageFillTiled /home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:2108:17
    #5 0x1592abc in php_gd_gdImageFill /home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:1999:3
    #6 0x143c9df in zif_imagefill /home/w023dtc/nightly_php/php-src/ext/gd/gd.c:2701:2
    #7 0x5ffc69f in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:1410:2
    #8 0x5b18433 in execute_ex /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:113454:12
    #9 0x5b1a9bc in zend_execute /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:119146:2
    #10 0x689b019 in zend_execute_script /home/w023dtc/nightly_php/php-src/Zend/zend.c:1977:3
    #11 0x507d5ba in php_execute_script_ex /home/w023dtc/nightly_php/php-src/main/main.c:2608:13
    #12 0x507e6f8 in php_execute_script /home/w023dtc/nightly_php/php-src/main/main.c:2648:9
    #13 0x68aff2a in do_cli /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:952:5
    #14 0x68aa30f in main /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:1363:18
    #15 0x14b62a368d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:2121:24 in php_gd__gdImageFillTiled
Shadow bytes around the buggy address:
  0x0c247fffe8c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fffe8d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fffe8e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fffe8f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fffe900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c247fffe910: fa fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa
  0x0c247fffe920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fffe930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fffe940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fffe950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fffe960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==70==ABORTING

USE_ZEND_ALLOC=0

PHP Version
nightly
Operating System

ubuntu 22.04

主要語言
C
星號
40.4k
分支
8.2k
平均合併
2 天 15 小時
30 天內合併 PR
103

貢獻指南

開啟貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

php/php-src 的其他 Issue

查看 php/php-src 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。