Edit report at https://bugs.php.net/bug.php?id=62523&edit=1
ID: 62523
Updated by: larue...@php.net
Reported by: bigbug at mafia dot lv
Summary: php crashes with segfault when exif_read_data called
-Status: Feedback
+Status: Re-Opened
Type: Bug
Package: Reproducible crash
Operating System: linux
PHP Version: 5.3Git-2012-07-10 (snap)
Block user comment: N
Private report: N
New Comment:
I can reproduce this only in 5.3, seems 5.3 and 5.4 have the same exif code,
but can not reproduce this in 5.4.
#0 0x00002b6649bdd8fe in php_ifd_get16u (value=0xffffffffcc675e60,
motorola_intel=0)
at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1095
1095 return (((uchar *)value)[1] << 8) | ((uchar *)value)[0];
(gdb) bt
#0 0x00002b6649bdd8fe in php_ifd_get16u (value=0xffffffffcc675e60,
motorola_intel=0)
at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1095
#1 0x00002b6649bdeba8 in exif_iif_add_value (image_info=0x7fff7b6ec450,
section_index=13, name=0x7fff7b6ebbb0 "CustomFunctions", tag=15,
format=3, length=12, value=0xffffffffcc675e60, motorola_intel=0) at
/home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1762
#2 0x00002b6649bded63 in exif_iif_add_tag (image_info=0x7fff7b6ec450,
section_index=13, name=0x7fff7b6ebbb0 "CustomFunctions", tag=15,
format=3, length=12, value=0xffffffffcc675e60) at
/home/huixinchen/opensource/php-5.3/ext/exif/exif.c:1812
#3 0x00002b6649be23e3 in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450,
dir_entry=0x1eb512d8 "\017",
offset_base=0xffffffffcc67493c <Address 0xffffffffcc67493c out of bounds>,
IFDlength=13482, displacement=30, section_index=13,
ReadNextIFD=0, tag_table=0x2b6649de9b00) at /home/huixinchen/opensource/php-
5.3/ext/exif/exif.c:3135
#4 0x00002b6649be123b in exif_process_IFD_in_MAKERNOTE
(ImageInfo=0x7fff7b6ec450, value_ptr=0x1eb512ca "\027", value_len=3476,
offset_base=0xffffffffcc67493c <Address 0xffffffffcc67493c out of bounds>,
IFDlength=13482, displacement=30)
at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:2813
#5 0x00002b6649be221f in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450,
dir_entry=0x1eb5085c "|\222\a", offset_base=0x1eb4fec0 "II*",
IFDlength=13482, displacement=30, section_index=7, ReadNextIFD=1,
tag_table=0x2b6649de88e0)
at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3089
#6 0x00002b6649be256f in exif_process_IFD_in_JPEG (ImageInfo=0x7fff7b6ec450,
dir_start=0x1eb507b2 "\037", offset_base=0x1eb4fec0 "II*",
IFDlength=13482, displacement=30, section_index=7) at
/home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3163
#7 0x00002b6649be2385 in exif_process_IFD_TAG (ImageInfo=0x7fff7b6ec450,
dir_entry=0x1eb4ff36 "i\207\004", offset_base=0x1eb4fec0 "II*",
IFDlength=13482, displacement=30, section_index=3, ReadNextIFD=1,
tag_table=0x2b6649de88e0)
at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3126
#8 0x00002b6649be256f in exif_process_IFD_in_JPEG (ImageInfo=0x7fff7b6ec450,
dir_start=0x1eb4fec8 "\v", offset_base=0x1eb4fec0 "II*",
IFDlength=13482, displacement=30, section_index=3) at
/home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3163
#9 0x00002b6649be285a in exif_process_TIFF_in_JPEG (ImageInfo=0x7fff7b6ec450,
CharBuf=0x1eb4fec0 "II*", length=13482, displacement=30)
at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3240
#10 0x00002b6649be298c in exif_process_APP1 (ImageInfo=0x7fff7b6ec450,
CharBuf=0x1eb4feb8 "4²Exif", length=13490, displacement=22)
at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3265
#11 0x00002b6649be2f1d in exif_scan_JPEG_header (ImageInfo=0x7fff7b6ec450) at
/home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3410
#12 0x00002b6649be3ffd in exif_scan_FILE_header (ImageInfo=0x7fff7b6ec450) at
/home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3792
#13 0x00002b6649be4c41 in exif_read_file (ImageInfo=0x7fff7b6ec450,
FileName=0x1eb4b8e8 "/tmp/1.orig.jpg", read_thumbnail=0, read_all=0)
at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3931
#14 0x00002b6649be4e27 in zif_exif_read_data (ht=1, return_value=0x1eb4aac0,
return_value_ptr=0x0, this_ptr=0x0, return_value_used=1)
at /home/huixinchen/opensource/php-5.3/ext/exif/exif.c:3984
#15 0x00000000008e7d95 in zend_do_fcall_common_helper_SPEC
(execute_data=0x2b664a23b090)
at /home/huixinchen/opensource/php-5.3/Zend/zend_vm_execute.h:320
#16 0x00000000008ed77c in ZEND_DO_FCALL_SPEC_CONST_HANDLER
(execute_data=0x2b664a23b090)
at /home/huixinchen/opensource/php-5.3/Zend/zend_vm_execute.h:1640
---Type <return> to continue, or q <return> to quit---
Previous Comments:
------------------------------------------------------------------------
[2012-07-10 16:11:45] larue...@php.net
yeah, please, build with -g, give us more info :), thanks
------------------------------------------------------------------------
[2012-07-10 13:59:20] bigbug at mafia dot lv
The file causing crash http://2000.lv/1.orig.jpg
------------------------------------------------------------------------
[2012-07-10 13:55:24] bigbug at mafia dot lv
Description:
------------
i got the jpeg file which is crashing our production server when exif_read_data
is called. I have testet with latest 5.3 snapshot, same there. Same results for
5.2 version, same results with 32 or 64bit versions.
Test script:
---------------
<?php
exif_read_data("1.orig.jpg");
?>
Expected result:
----------------
return the array of exif data
Actual result:
--------------
Reading symbols from /usr/bin/php...(no debugging symbols found)...done.
[New LWP 27266]
warning: Can't read pathname for load map: Input/output error.
[Thread debugging using libthread_db enabled]
Core was generated by `php filed.php'.
Program terminated with signal 11, Segmentation fault.
#0 0x080e5046 in ?? ()
(gdb) bt
#0 0x080e5046 in ?? ()
#1 0x080e561d in ?? ()
#2 0x080e60b3 in ?? ()
#3 0x080e6bbe in ?? ()
#4 0x080e70ef in ?? ()
#5 0x080e6e00 in ?? ()
#6 0x080e70ef in ?? ()
#7 0x080e906c in ?? ()
#8 0x080e92c2 in ?? ()
#9 0x083985ca in ?? ()
#10 0x0834344e in execute ()
#11 0x0831c199 in zend_execute_scripts ()
#12 0x082c2dce in php_execute_script ()
#13 0x0806b47f in ?? ()
#14 0x0077c113 in __libc_start_main () from /lib/i386-linux-gnu/libc.so.6
#15 0x0806b521 in _start ()
Shoid i build php with debug symbols?
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=62523&edit=1
