diff options
Diffstat (limited to 'meta-oe/recipes-devtools/php/php-5.6.12/CVE-2016-1903.patch')
-rw-r--r-- | meta-oe/recipes-devtools/php/php-5.6.12/CVE-2016-1903.patch | 55 |
1 files changed, 0 insertions, 55 deletions
diff --git a/meta-oe/recipes-devtools/php/php-5.6.12/CVE-2016-1903.patch b/meta-oe/recipes-devtools/php/php-5.6.12/CVE-2016-1903.patch deleted file mode 100644 index a7c35fe43..000000000 --- a/meta-oe/recipes-devtools/php/php-5.6.12/CVE-2016-1903.patch +++ /dev/null | |||
@@ -1,55 +0,0 @@ | |||
1 | From 4b8394dd78571826ac66a69dc240c623f31d78f8 Mon Sep 17 00:00:00 2001 | ||
2 | From: Stanislav Malyshev <stas@php.net> | ||
3 | Date: Mon, 7 Dec 2015 23:30:49 -0800 | ||
4 | Subject: [PATCH] Fix bug #70976: fix boundary check on | ||
5 | gdImageRotateInterpolated | ||
6 | |||
7 | Upstream-Status: Backport | ||
8 | |||
9 | https://git.php.net/?p=php-src.git;a=commit;h=4b8394dd78571826ac66a69dc240c623f31d78f8 | ||
10 | |||
11 | CVE: CVE-2016-1903 | ||
12 | Signed-off-by: Armin Kuster <akuster@mvista.com> | ||
13 | |||
14 | --- | ||
15 | ext/gd/libgd/gd_interpolation.c | 2 +- | ||
16 | ext/gd/tests/bug70976.phpt | 13 +++++++++++++ | ||
17 | 2 files changed, 14 insertions(+), 1 deletion(-) | ||
18 | create mode 100644 ext/gd/tests/bug70976.phpt | ||
19 | |||
20 | diff --git a/ext/gd/libgd/gd_interpolation.c b/ext/gd/libgd/gd_interpolation.c | ||
21 | index f70169d..0f874ac 100644 | ||
22 | --- a/ext/gd/libgd/gd_interpolation.c | ||
23 | +++ b/ext/gd/libgd/gd_interpolation.c | ||
24 | @@ -2162,7 +2162,7 @@ gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, in | ||
25 | { | ||
26 | const int angle_rounded = (int)floor(angle * 100); | ||
27 | |||
28 | - if (bgcolor < 0) { | ||
29 | + if (bgcolor < 0 || bgcolor >= gdMaxColors) { | ||
30 | return NULL; | ||
31 | } | ||
32 | |||
33 | diff --git a/ext/gd/tests/bug70976.phpt b/ext/gd/tests/bug70976.phpt | ||
34 | new file mode 100644 | ||
35 | index 0000000..23af4ee | ||
36 | --- /dev/null | ||
37 | +++ b/ext/gd/tests/bug70976.phpt | ||
38 | @@ -0,0 +1,13 @@ | ||
39 | +--TEST-- | ||
40 | +Bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds) | ||
41 | +--SKIPIF-- | ||
42 | +<?php | ||
43 | + if(!extension_loaded('gd')){ die('skip gd extension not available'); } | ||
44 | +?> | ||
45 | +--FILE-- | ||
46 | +<?php | ||
47 | +$img = imagerotate(imagecreate(1,1),45,0x7ffffff9); | ||
48 | +var_dump($img); | ||
49 | +?> | ||
50 | +--EXPECTF-- | ||
51 | +bool(false) | ||
52 | \ No newline at end of file | ||
53 | -- | ||
54 | 2.3.5 | ||
55 | |||