Skip to content

Commit ff577b0

Browse files
cmb69smalyshev
authored andcommitted
Fix #79877: getimagesize function silently truncates after a null byte
We have to check for NUL bytes if `getimagesize()` has been called.
1 parent 7355ab8 commit ff577b0

File tree

2 files changed

+14
-0
lines changed

2 files changed

+14
-0
lines changed

ext/standard/image.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1478,6 +1478,11 @@ static void php_getimagesize_from_any(INTERNAL_FUNCTION_PARAMETERS, int mode) {
14781478
Z_PARAM_ZVAL_DEREF(info)
14791479
ZEND_PARSE_PARAMETERS_END();
14801480

1481+
if (mode == FROM_PATH && CHECK_NULL_PATH(input, input_len)) {
1482+
php_error_docref(NULL, E_WARNING, "Invalid path");
1483+
return;
1484+
}
1485+
14811486
if (argc == 2) {
14821487
zval_ptr_dtor(info);
14831488
array_init(info);
Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
--TEST--
2+
Bug #79877 (getimagesize function silently truncates after a null byte)
3+
--FILE--
4+
<?php
5+
var_dump(getimagesize("/tmp/a.png\0xx"));
6+
?>
7+
--EXPECTF--
8+
Warning: getimagesize(): Invalid path in %s on line %d
9+
NULL

0 commit comments

Comments
 (0)