Repository navigation
UBSan alert in ext/gd/libgd/wbmp.c:47 #16232
Description
Description
The following code:
<?php
$filename = __DIR__ . '/_tmp.wbmp';
$fp = fopen($filename,"wb");
$c = 0;
fputs($fp, chr($c), 1);
fputs($fp, $c, 1);
$c = 0x84;
for ($i=0; $i<10000; $i++) {
fwrite($fp, chr($c), 1);
}
$im = imagecreatefromwbmp($filename);Resulted in this output:
/php-src/ext/gd/libgd/wbmp.c:47:18: runtime error: left shift of 1082196484 by 7 places cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/gd/libgd/wbmp.c:47:18
PHP Version
PHP 8.4.0-dev
Operating System
ubuntu 22.04
Activity
ndossche commentedon Oct 5, 2024
@YuanchengJiang libgd is a bundled library, you should actually report this upstream as well: https://github.com/libgd/libgd
Fix phpGH-16232: bitshift overflow on wbmp file content reading.
Fix GH-16232: bitshift overflow on wbmp file content reading.