[Security] Fix PHP 74435 - Buffer over-read into uninitialized memory

fredemmott · fredemmott · commit 54aeb01fb1c9 · 2017-12-20T11:29:46.000-08:00
diff --git a/hphp/runtime/ext/gd/libgd/gd_gif_in.cpp b/hphp/runtime/ext/gd/libgd/gd_gif_in.cpp
@@ -146,6 +146,9 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd) /* {{{ */
   int haveGlobalColormap;
   gdImagePtr im = 0;
 
+  memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE);
+  memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE);
+
   /*1.4//imageNumber = 1; */
   if (! ReadOK(fd,buf,6)) {
     return 0;
diff --git a/hphp/test/zend/good/ext/gd/tests/bug74435.gif b/hphp/test/zend/good/ext/gd/tests/bug74435.gif
diff --git a/hphp/test/zend/good/ext/gd/tests/bug74435.php b/hphp/test/zend/good/ext/gd/tests/bug74435.php
@@ -0,0 +1,16 @@
+<?php
+$im = imagecreatefromgif(__DIR__ . DIRECTORY_SEPARATOR . 'bug74435.gif');
+var_dump($im);
+$width = imagesx($im);
+$height = imagesy($im);
+for ($i = 0; $i < $width; $i += 16) {
+    for ($j = 0; $j < $height; $j += 16) {
+        if (($index = imagecolorat($im, $i, $j)) >= 2) {
+            list($red, $green, $blue, $alpha) = array_values(imagecolorsforindex($im, $index));
+            if ($red !== 0 || $green !== 0 || $blue !== 0 || $alpha !== 0) {
+                echo "unexpected color at ($i, $j)\n";
+            }
+        }
+    }
+}
+?>
diff --git a/hphp/test/zend/good/ext/gd/tests/bug74435.php.expectf b/hphp/test/zend/good/ext/gd/tests/bug74435.php.expectf
@@ -0,0 +1,2 @@
+resource(%d) of type (gd)
+
diff --git a/hphp/test/zend/good/ext/gd/tests/bug74435.php.skipif b/hphp/test/zend/good/ext/gd/tests/bug74435.php.skipif
@@ -0,0 +1,3 @@
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
