[security] [CVE-2018-5711] Sec Bug #75571: Potential infinite loop in gdImageCreateFromGifCtx

paulbiss · fredemmott · commit 2e4b6edb6a4e · 2018-05-03T12:30:21.000-07:00
CVE-2018-5711
diff --git a/hphp/runtime/ext/gd/libgd/gd_gif_in.cpp b/hphp/runtime/ext/gd/libgd/gd_gif_in.cpp
@@ -258,10 +258,6 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd) /* {{{ */
   if (!im) {
     return 0;
   }
-  if (!im->colorsTotal) {
-    gdImageDestroy(im);
-    return 0;
-  }
   /* Check for open colors at the end, so
      we can reduce colorsTotal and ultimately
      BitsPerPixel */
@@ -272,6 +268,10 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd) /* {{{ */
       break;
     }
   }
+  if (!im->colorsTotal) {
+    gdImageDestroy(im);
+    return 0;
+  }
   return im;
 }
 /* }}} */
@@ -372,7 +372,7 @@ static int
 GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP)
 {
   int           i, j, ret;
-  unsigned char count;
+  int           count;
 
   if (flag) {
     scd->curbit = 0;
diff --git a/hphp/test/zend/good/ext/gd/tests/bug75571.gif b/hphp/test/zend/good/ext/gd/tests/bug75571.gif
diff --git a/hphp/test/zend/good/ext/gd/tests/bug75571.php b/hphp/test/zend/good/ext/gd/tests/bug75571.php
@@ -0,0 +1,3 @@
+<?php
+var_dump(imagecreatefromgif(__DIR__ . '/bug75571.gif'));
+?>
diff --git a/hphp/test/zend/good/ext/gd/tests/bug75571.php.expectf b/hphp/test/zend/good/ext/gd/tests/bug75571.php.expectf
@@ -0,0 +1,3 @@
+Warning: '%s' is not a valid GIF file in %s on line %d
+bool(false)
+
diff --git a/hphp/test/zend/good/ext/gd/tests/bug75571.php.skipif b/hphp/test/zend/good/ext/gd/tests/bug75571.php.skipif
@@ -0,0 +1,3 @@
+<?php
+        if (!function_exists('imagetypes')) die("skip gd extension not available\n");
+?>
