Skip to content

Commit 37d0c7b

Browse files
committed
Simplify GD null byte injection tests
These tests actually check that no file with a name containing a NUL is created by the GD image output functions. This is superfluous, since it is sufficient to check that the function failed, and that an appropriate warning has been raised. We also add missing nullbyte injection tests.
1 parent 2f1d822 commit 37d0c7b

9 files changed

+43
-126
lines changed
Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
Testing null byte injection in imagebmp
3+
--SKIPIF--
4+
<?php
5+
if(!extension_loaded('gd')) die('skip gd extension not available');
6+
if (!gd_info()['BMP Support']) die('skip BMP support not available');
7+
?>
8+
--FILE--
9+
<?php
10+
$image = imagecreate(1,1);// 1px image
11+
var_dump(imagebmp($image, "./foo\0bar"));
12+
?>
13+
===DONE===
14+
--EXPECTF--
15+
Warning: imagebmp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
16+
bool(false)
17+
===DONE===

ext/gd/tests/imagegd2_nullbyte_injection.phpt

Lines changed: 3 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -4,29 +4,11 @@ Testing null byte injection in imagegd2
44
<?php
55
if(!extension_loaded('gd')){ die('skip gd extension not available'); }
66
?>
7-
--CLEAN--
8-
$tempdir = sprintf("%s/%s", sys_get_temp_dir(), preg_replace("~\.php$~", null, __FILE__));
9-
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
10-
rmdir($tempdir);
117
--FILE--
128
<?php
139
$image = imagecreate(1,1);// 1px image
14-
15-
$tempdir = sprintf("%s/%s", sys_get_temp_dir(), preg_replace("~\.php$~", null, __FILE__));
16-
if (!is_dir($tempdir)) {
17-
mkdir ($tempdir, 0777, true);
18-
}
19-
20-
$userinput = "1\0"; // from post or get data
21-
$temp = $tempdir. "/test" . $userinput .".tmp";
22-
23-
echo "\nimagegd2 TEST\n";
24-
imagegd2($image, $temp);
25-
var_dump(file_exists($tempdir. "/test1"));
26-
var_dump(file_exists($tempdir. "/test1.tmp"));
10+
var_dump(imagegd2($image, "./foo\0bar"));
11+
?>
2712
--EXPECTF--
28-
imagegd2 TEST
29-
3013
Warning: imagegd2() expects parameter 2 to be a valid path, string given in %s on line %d
31-
bool(false)
32-
bool(false)
14+
NULL

ext/gd/tests/imagegd_nullbyte_injection.phpt

Lines changed: 2 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -4,30 +4,11 @@ Testing null byte injection in imagegd
44
<?php
55
if(!extension_loaded('gd')){ die('skip gd extension not available'); }
66
?>
7-
--CLEAN--
8-
$tempdir = sprintf("%s/%s", sys_get_temp_dir(), preg_replace("~\.php$~", null, __FILE__));
9-
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
10-
rmdir($tempdir);
117
--FILE--
128
<?php
139
$image = imagecreate(1,1);// 1px image
14-
15-
$tempdir = sprintf("%s/%s", sys_get_temp_dir(), preg_replace("~\.php$~", null, __FILE__));
16-
if (!is_dir($tempdir)) {
17-
mkdir ($tempdir, 0777, true);
18-
}
19-
20-
$userinput = "1\0"; // from post or get data
21-
$temp = $tempdir. "/test" . $userinput .".tmp";
22-
23-
echo "\nimagegd TEST\n";
24-
imagegd($image, $temp);
25-
var_dump(file_exists($tempdir. "/test1"));
26-
var_dump(file_exists($tempdir. "/test1.tmp"));
10+
var_dump(imagegd($image, "./foo\0bar"));
2711
?>
2812
--EXPECTF--
29-
imagegd TEST
30-
3113
Warning: imagegd() expects parameter 2 to be a valid path, string given in %s on line %d
32-
bool(false)
33-
bool(false)
14+
NULL

ext/gd/tests/imagegif_nullbyte_injection.phpt

Lines changed: 1 addition & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,6 @@ Testing null byte injection in imagegif
33
--SKIPIF--
44
<?php
55
if(!extension_loaded('gd')){ die('skip gd extension not available'); }
6-
$support = gd_info();
7-
if (!isset($support['GIF Create Support']) || $support['GIF Create Support'] === false) {
8-
print 'skip gif support not available';
9-
}
106
?>
117
--CLEAN--
128
$tempdir = sprintf("%s/%s", sys_get_temp_dir(), preg_replace("~\.php$~", null, __FILE__));
@@ -15,23 +11,8 @@ rmdir($tempdir);
1511
--FILE--
1612
<?php
1713
$image = imagecreate(1,1);// 1px image
18-
19-
$tempdir = sprintf("%s/%s", sys_get_temp_dir(), preg_replace("~\.php$~", null, __FILE__));
20-
if (!is_dir($tempdir)) {
21-
mkdir ($tempdir, 0777, true);
22-
}
23-
24-
$userinput = "1\0"; // from post or get data
25-
$temp = $tempdir. "/test" . $userinput .".tmp";
26-
27-
echo "\nimagegif TEST\n";
28-
imagegif($image, $temp);
29-
var_dump(file_exists($tempdir. "/test1"));
30-
var_dump(file_exists($tempdir. "/test1.tmp"));
14+
var_dump(imagegif($image, "./foo\0bar"));
3115
?>
3216
--EXPECTF--
33-
imagegif TEST
34-
3517
Warning: imagegif(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
3618
bool(false)
37-
bool(false)

ext/gd/tests/imagejpeg_nullbyte_injection.phpt

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,8 @@ rmdir($tempdir);
1515
--FILE--
1616
<?php
1717
$image = imagecreate(1,1);// 1px image
18-
19-
$tempdir = sprintf("%s/%s", sys_get_temp_dir(), preg_replace("~\.php$~", null, __FILE__));
20-
if (!is_dir($tempdir)) {
21-
mkdir ($tempdir, 0777, true);
22-
}
23-
24-
$userinput = "1\0"; // from post or get data
25-
$temp = $tempdir. "/test" . $userinput .".tmp";
26-
27-
echo "\nimagejpeg TEST\n";
28-
imagejpeg($image, $temp);
29-
var_dump(file_exists($tempdir. "/test1"));
30-
var_dump(file_exists($tempdir. "/test1.tmp"));
18+
var_dump(imagejpeg($image, "./foo\0bar"));
3119
?>
3220
--EXPECTF--
33-
imagejpeg TEST
34-
3521
Warning: imagejpeg(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
3622
bool(false)
37-
bool(false)

ext/gd/tests/imagepng_nullbyte_injection.phpt

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,8 @@ rmdir($tempdir);
1515
--FILE--
1616
<?php
1717
$image = imagecreate(1,1);// 1px image
18-
19-
$tempdir = sprintf("%s/%s", sys_get_temp_dir(), preg_replace("~\.php$~", null, __FILE__));
20-
if (!is_dir($tempdir)) {
21-
mkdir ($tempdir, 0777, true);
22-
}
23-
24-
$userinput = "1\0"; // from post or get data
25-
$temp = $tempdir. "/test" . $userinput .".tmp";
26-
27-
echo "\nimagepng TEST\n";
28-
imagepng($image, $temp);
29-
var_dump(file_exists($tempdir. "/test1"));
30-
var_dump(file_exists($tempdir. "/test1.tmp"));
18+
var_dump(imagepng($image, "./foo\0bar"));
3119
?>
3220
--EXPECTF--
33-
imagepng TEST
34-
3521
Warning: imagepng(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
3622
bool(false)
37-
bool(false)

ext/gd/tests/imagewbmp_nullbyte_injection.phpt

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,8 @@ rmdir($tempdir);
1515
--FILE--
1616
<?php
1717
$image = imagecreate(1,1);// 1px image
18-
19-
$tempdir = sprintf("%s/%s", sys_get_temp_dir(), preg_replace("~\.php$~", null, __FILE__));
20-
if (!is_dir($tempdir)) {
21-
mkdir ($tempdir, 0777, true);
22-
}
23-
24-
$userinput = "1\0"; // from post or get data
25-
$temp = $tempdir. "/test" . $userinput .".tmp";
26-
27-
echo "\nimagewbmp TEST\n";
28-
imagewbmp($image, $temp);
29-
var_dump(file_exists($tempdir. "/test1"));
30-
var_dump(file_exists($tempdir. "/test1.tmp"));
18+
var_dump(imagewbmp($image, "./foo\0bar"));
3119
?>
3220
--EXPECTF--
33-
imagewbmp TEST
34-
3521
Warning: imagewbmp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
3622
bool(false)
37-
bool(false)

ext/gd/tests/imagewebp_nullbyte_injection.phpt

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,8 @@ rmdir($tempdir);
1515
--FILE--
1616
<?php
1717
$image = imagecreate(1,1);// 1px image
18-
19-
$tempdir = sprintf("%s/%s", sys_get_temp_dir(), preg_replace("~\.php$~", null, __FILE__));
20-
if (!is_dir($tempdir)) {
21-
mkdir ($tempdir, 0777, true);
22-
}
23-
24-
$userinput = "1\0"; // from post or get data
25-
$temp = $tempdir. "/test" . $userinput .".tmp";
26-
27-
echo "\nimagewebp TEST\n";
28-
imagewebp($image, $temp);
29-
var_dump(file_exists($tempdir. "/test1"));
30-
var_dump(file_exists($tempdir. "/test1.tmp"));
18+
var_dump(imagewebp($image, "./foo\0bar"));
3119
?>
3220
--EXPECTF--
33-
imagewebp TEST
34-
3521
Warning: imagewebp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
3622
bool(false)
37-
bool(false)
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Testing null byte injection in imagexbm
3+
--SKIPIF--
4+
<?php
5+
if(!extension_loaded('gd')) die('skip gd extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
$image = imagecreate(1,1);// 1px image
10+
var_dump(imagexbm($image, "./foo\0bar"));
11+
?>
12+
===DONE===
13+
--EXPECTF--
14+
Warning: imagexbm() expects parameter 2 to be a valid path, string given in %s on line %d
15+
NULL
16+
===DONE===

0 commit comments

Comments
 (0)