Nothing Special   »   [go: up one dir, main page]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

UBSan alert in ext/gd/libgd/wbmp.c:47 #16232

Closed
YuanchengJiang opened this issue Oct 5, 2024 · 1 comment
Closed

UBSan alert in ext/gd/libgd/wbmp.c:47 #16232

YuanchengJiang opened this issue Oct 5, 2024 · 1 comment
Assignees
@devnexen
Labels
Bug Extension: gd Status: Verified

Comments

@YuanchengJiang
Copy link

Description

The following code:

<?php
$filename = __DIR__ . '/_tmp.wbmp';
$fp = fopen($filename,"wb");
$c = 0;
fputs($fp, chr($c), 1);
fputs($fp, $c, 1);
$c = 0x84;
for ($i=0; $i<10000; $i++) {
fwrite($fp, chr($c), 1);
}
$im = imagecreatefromwbmp($filename);

Resulted in this output:

/php-src/ext/gd/libgd/wbmp.c:47:18: runtime error: left shift of 1082196484 by 7 places cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/gd/libgd/wbmp.c:47:18

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04
@devnexen devnexen self-assigned this Oct 5, 2024
devnexen added a commit to devnexen/php-src that referenced this issue Oct 5, 2024
@devnexen
Fix phpGH-16232: bitshift overflow on wbmp file content reading.
e760ef8
devnexen added a commit to devnexen/php-src that referenced this issue Oct 5, 2024
@devnexen
Fix phpGH-16232: bitshift overflow on wbmp file content reading.
5a21266
@devnexen devnexen linked a pull request Oct 5, 2024 that will close this issue
Fix GH-16232: bitshift overflow on wbmp file content reading. #16239
Closed
@nielsdos
Copy link
Member
nielsdos commented Oct 5, 2024

@YuanchengJiang libgd is a bundled library, you should actually report this upstream as well: https://github.com/libgd/libgd

devnexen added a commit to devnexen/php-src that referenced this issue Oct 5, 2024
@devnexen
Fix phpGH-16232: bitshift overflow on wbmp file content reading.
ad43470 
backport from libgd/libgd@a8f1d5c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@devnexen devnexen

Labels
Bug Extension: gd Status: Verified
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix GH-16232: bitshift overflow on wbmp file content reading. devnexen/php-src
3 participants
@devnexen @nielsdos @YuanchengJiang