Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 179158 - dev-lang/php Possible infinite included loop in libgd/gd_png.c (inside png_set_read_fn() callback) with truncated input (CVE-2007-2756)
Summary: dev-lang/php Possible infinite included loop in libgd/gd_png.c (inside png_se...
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
Whiteboard: B2? [glsa] jaervosz
Depends on: 179154
  Show dependency tree
Reported: 2007-05-19 22:18 UTC by Sune Kloppenborg Jeppesen (RETIRED)
Modified: 2007-10-07 11:28 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2007-05-19 22:18:12 UTC
php includes a local libgd copy.

+++ This bug was initially created as a clone of Bug #179154 +++

The following test case using libgd 2.0.34 apparently leads to an infinite loop in the libpng decoder. 
 The infinite loop seems to occur between the libpng code (png_read_data()) and the libgd callback (gdPngReadData()) which may not properly detect truncated input. The libpng’s png_read_info() function hence never returns, and the library consumme 100% CPU. 
/* id: gdbad3.c, Xavier Roche, May. 2007 */
/* gcc gdbad3.c -o bad -lgd && ./bad */

#include <stdio.h>
#include <stdlib.h>
#include "gd.h"

static const unsigned char pngdata[93];
int main(void) {
  gdImagePtr im;
  if ( ( im = gdImageCreateFromPngPtr(93, (char*) &pngdata[0]) ) != NULL) {
    fprintf(stderr, "success!\n");
  } else {
    fprintf(stderr, "failed!\n");
  return 0;

/* PNG data */
static const unsigned char pngdata[93] = {137,80,78,71,13,10,26,10,0,0,

 Typical stack: 
(gdb) where
#0  gdPngReadData (png_ptr=0x501090, data=0x501570 "", length=5247120) at gd_png.c:83
#1  0x00002af9ef5ab192 in png_read_data (png_ptr=0x501090, data=0x501570 "", length=9) at pngrio.c:33
#2  0x00002af9ef5a1935 in png_crc_read (png_ptr=0x501090, buf=0x501570 "", length=9) at pngrutil.c:96
#3  0x00002af9ef5a1a17 in png_crc_finish (png_ptr=0x501090, skip=5248368) at pngrutil.c:116
#4  0x00002af9ef5a425a in png_handle_unknown (png_ptr=0x501090, info_ptr=0x505ae0, length=9)
    at pngrutil.c:2221
#5  0x00002af9ef5a9e0d in png_read_info (png_ptr=0x501090, info_ptr=0x505ae0) at pngread.c:530
#6  0x00002af9eeb2baf9 in gdImageCreateFromPngCtx (infile=0x501010) at gd_png.c:189
#7  0x00002af9eeb2b9b0 in gdImageCreateFromPngPtr (size=5247120, data=0x501570) at gd_png.c:111
#8  0x00000000004006df in main ()

 (if you ‘up’ to png_read_info() and try ‘finish’, you’ll see that this function never returns due to endless calls to gdPngReadData())
Comment 1 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2007-05-19 22:25:46 UTC
php please advise.
Comment 2 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2007-06-03 15:21:36 UTC
php please advise.
Comment 3 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2007-06-16 07:00:46 UTC
php please advise.
Comment 4 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2007-07-01 02:20:55 UTC
php please advise.
Comment 5 Christian Hoffmann (RETIRED) gentoo-dev 2007-07-04 19:54:00 UTC
JFYI: This bug has been fixed in >=php-5.2.3 (see; this version of php is only available in the php overlay atm.
Comment 6 Pierre-Yves Rofes (RETIRED) gentoo-dev 2007-07-19 08:10:11 UTC
php, what's the status here?
Comment 7 Christian Hoffmann (RETIRED) gentoo-dev 2007-07-19 10:06:49 UTC
Same as with -- will be fixed once >=php-5.2.3-r2 from the overlay gets merged into the tree.
Comment 8 Pierre-Yves Rofes (RETIRED) gentoo-dev 2007-08-07 14:41:43 UTC
afaict php-5.2.3-r3 seems stable on all security supported arches, so ready for glsa. maybe we could mention this issue as part of the GD draft. security, please comment.
Comment 9 Pierre-Yves Rofes (RETIRED) gentoo-dev 2007-10-07 11:28:29 UTC
GLSA 200710-02, sorry for the delay.