hitoshura25/cvefixes huggingface dataset:
CVE-2016-5096 (C, published 2016-08-07T10:59Z)
Description: value: Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument.
Severity: HIGH (CVSS v3 base score: 8.6)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/php/php-src
Files changed:
ext/standard/file.c
ext/standard/tests/file/bug72114.phpt
Commit message: Fix bug #72114 - int/size_t confusion in fread


Vulnerable code:

Fixed code:
	if (len > INT_MAX) {
		/* string length is int in 5.x so we can not read more than int */
		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be no more than %d", INT_MAX);
		RETURN_FALSE;
	}

--TEST--
Bug #72114 (Integer underflow / arbitrary null write in fread/gzread)
--FILE--
<?php
ini_set('memory_limit', "2500M");
$fp = fopen("/dev/zero", "r");
fread($fp, 2147483648);
?>
Done
--EXPECTF--
Warning: fread(): Length parameter must be no more than 2147483647 in %s/bug72114.php on line %d
Done
CVE-2016-5766 (C, published 2016-08-07T10:59Z)
Description: value: Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/php/php-src
Files changed:
ext/gd/libgd/gd_gd2.c
ext/gd/tests/bug72339.phpt
Commit message: Fixed #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow


Vulnerable code:

Fixed code:
		if (overflow2(sidx, nc)) {
			goto fail1;
		}
		if (cidx == NULL) {
			goto fail1;
		}

--TEST--
Bug #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow 
--SKIPIF--
<?php if (!function_exists("imagecreatefromgd2")) print "skip"; ?>
--FILE--
<?php imagecreatefromgd2(dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug72339.gd"); ?>
--EXPECTF--	
Warning: imagecreatefromgd2(): gd warning: product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
 in %sbug72339.php on line %d

Warning: imagecreatefromgd2(): '%sbug72339.gd' is not a valid GD2 file in %sbug72339.php on line %d
CVE-2016-5767 (Other, published 2016-08-07T10:59Z)
Description: value: Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/php/php-src
Files changed:
NEWS
ext/gd/libgd/gd.c
Commit message: iFixed bug #72446 - Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow


Vulnerable code:
		/* 
		gdImageAALine(im, x1, y1, x2, y2, im->AA_color); 
	alphablending_bak = im->alphaBlendingFlag;	
		im->alphaBlendingFlag = alphablending_bak;	
	im->alphaBlendingFlag = alphablending_bak;	
		
	
	
    

Fixed code:
  . Fixed bug #72446 (Integer Overflow in gdImagePaletteToTrueColor() resulting
    in heap overflow). (Pierre)
	if (overflow2(sizeof(unsigned char *), sx)) {
		return NULL;
	}

		/*
		gdImageAALine(im, x1, y1, x2, y2, im->AA_color);
	alphablending_bak = im->alphaBlendingFlag;
		im->alphaBlendingFlag = alphablending_bak;
	im->alphaBlendingFlag = alphablending_bak;
CVE-2016-5768 (C, published 2016-08-07T10:59Z)
Description: value: Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/php/php-src
Files changed:
ext/mbstring/php_mbregex.c
ext/mbstring/tests/bug72402.phpt
Commit message: Fix bug #72402: _php_mb_regex_ereg_replace_exec - double free


Vulnerable code:
 
static void php_mb_regex_free_cache(php_mb_regex_t **pre) 
static void _php_mb_regex_globals_dtor(zend_mb_regex_globals *pglobals TSRMLS_DC) 
	return retval; 
		++len_req;	
		++len_req;	
		++len_req;	
			++len_req;	
			++len_req;	
	}	
		++len_req;	
		++len_req;	
	++len_req;	
_php_mb_regex_init_options(const char *parg, int narg, OnigOptionType *option, OnigSyntaxType **syntax, int *eval) 
	int optm = 0; 
					if (eval != NULL) *eval = 1; 
		if (option != NULL) *option|=optm; 
		pat_buf[0] = (char)Z_LVAL_PP(arg_pattern_zval);	
		arg_pattern_len = 1;	
				
				zval *retval_ptr;
				
				
				}				
				
				
				if (zend_call_function(&arg_replace_fci, &arg_replace_fci_cache TSRMLS_CC) == SUCCESS && arg_replace_fci.retval_ptr_ptr) {
					efree(description);
					smart_str_appendl(&out_buf, pos, 1); 
		smart_str_free(&out_buf);	
	} 
	
static void _php_mb_regex_set_options(OnigOptionType options, OnigSyntaxType *syntax, OnigOptionType *prev_options, OnigSyntaxType **prev_syntax TSRMLS_DC) 

Fixed code:

static void php_mb_regex_free_cache(php_mb_regex_t **pre)
static void _php_mb_regex_globals_dtor(zend_mb_regex_globals *pglobals TSRMLS_DC)
	return retval;
		++len_req;
		++len_req;
		++len_req;
			++len_req;
			++len_req;
	}
		++len_req;
		++len_req;
	++len_req;
_php_mb_regex_init_options(const char *parg, int narg, OnigOptionType *option, OnigSyntaxType **syntax, int *eval)
	int optm = 0;
					if (eval != NULL) *eval = 1;
		if (option != NULL) *option|=optm;
		pat_buf[0] = (char)Z_LVAL_PP(arg_pattern_zval);
		arg_pattern_len = 1;

				zval *retval_ptr = NULL;


				}


				if (zend_call_function(&arg_replace_fci, &arg_replace_fci_cache TSRMLS_CC) == SUCCESS && arg_replace_fci.retval_ptr_ptr && retval_ptr) {
					smart_str_appendl(&out_buf, pos, 1);
		smart_str_free(&out_buf);
	}

static void _php_mb_regex_set_options(OnigOptionType options, OnigSyntaxType *syntax, OnigOptionType *prev_options, OnigSyntaxType **prev_syntax TSRMLS_DC)
--TEST--
Bug #72402: _php_mb_regex_ereg_replace_exec - double free
--SKIPIF--
<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
--FILE--
<?php
function throwit() {
	throw new Exception('it');
}
$var10 = "throwit";
try {
	$var14 = mb_ereg_replace_callback("", $var10, "");
} catch(Exception $e) {}
?>
DONE
--EXPECT--
DONE
CVE-2016-5769 (C, published 2016-08-07T10:59Z)
Description: value: Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the (1) mcrypt_generic and (2) mdecrypt_generic functions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/php/php-src
Files changed:
ext/mcrypt/mcrypt.c
Commit message: Fix bug #72455:  Heap Overflow due to integer overflows


Vulnerable code:
typedef struct _php_mcrypt { 
	"mcrypt", 
	ZEND_FETCH_RESOURCE (pm, php_mcrypt *, &mcryptind, -1, "MCrypt", le_mcrypt);				
	if (pm) {	
	
   
	
		mode, 
	
	
	
	
	
	
	
		RETURN_TRUE 
	
	
	
	
	
	
	
	
	int   cipher_len, module_len; 
	
	int   cipher_len, module_len; 
	
	int   cipher_len, module_len; 
	
			if (key_length_sizes[i] >= key_len && 
	
	
	
	
	
	
	
	
	
	
	

Fixed code:
typedef struct _php_mcrypt {
	"mcrypt",
	ZEND_FETCH_RESOURCE (pm, php_mcrypt *, &mcryptind, -1, "MCrypt", le_mcrypt);
	if (pm) {



		mode,


		if (data_size <= 0) {
			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Integer overflow in data size");
			RETURN_FALSE;
		}



		if (data_size <= 0) {
			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Integer overflow in data size");
			RETURN_FALSE;
		}


		RETURN_TRUE








	int   cipher_len, module_len;

	int   cipher_len, module_len;

	int   cipher_len, module_len;

			if (key_length_sizes[i] >= key_len &&
CVE-2016-5771 (Other, published 2016-08-07T10:59Z)
Description: value: spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/php/php-src
Files changed:
Zend/tests/gc_024.phpt
ext/spl/spl_array.c
ext/standard/tests/strings/bug72433.phpt
Commit message: Fixed ##72433: Use After Free Vulnerability in PHP's GC algorithm and unserialize


Vulnerable code:
int(1)

Fixed code:
int(2)
static HashTable *spl_array_get_gc(zval *object, zval ***gc_data, int *gc_data_count TSRMLS_DC) /* {{{ */
{
	spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);

	*gc_data = &intern->array;
	*gc_data_count = 1;
	return zend_std_get_properties(object);
}
/* }}} */

	spl_handler_ArrayObject.get_gc = spl_array_get_gc;
--TEST--
Bug #72433: Use After Free Vulnerability in PHP's GC algorithm and unserialize
--FILE--
<?php
// Fill any potential freed spaces until now.
$filler = array();
for($i = 0; $i < 100; $i++)
	$filler[] = "";
// Create our payload and unserialize it.
$serialized_payload = 'a:3:{i:0;r:1;i:1;r:1;i:2;C:11:"ArrayObject":19:{x:i:0;r:1;;m:a:0:{}}}';
$free_me = unserialize($serialized_payload);
// We need to increment the reference counter of our ArrayObject s.t. all reference counters of our unserialized array become 0.
$inc_ref_by_one = $free_me[2];
// The call to gc_collect_cycles will free '$free_me'.
gc_collect_cycles();
// We now have multiple freed spaces. Fill all of them.
$fill_freed_space_1 = "filler_zval_1";
$fill_freed_space_2 = "filler_zval_2";
var_dump($free_me);
?>
--EXPECTF--
array(3) {
  [0]=>
  *RECURSION*
  [1]=>
  *RECURSION*
  [2]=>
  object(ArrayObject)#%d (1) {
    ["storage":"ArrayObject":private]=>
    *RECURSION*
  }
}
CVE-2016-5772 (C, published 2016-08-07T10:59Z)
Description: value: Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/php/php-src
Files changed:
ext/wddx/tests/bug72340.phpt
ext/wddx/wddx.c
Commit message: Fix bug #72340: Double Free Courruption in wddx_deserialize


Vulnerable code:

Fixed code:
--TEST--
Bug #72340: Double Free Courruption in wddx_deserialize
--SKIPIF--
<?php
if (!extension_loaded("wddx")) print "skip";
?>
--FILE--
<?php
$xml = <<<EOF
<?xml version='1.0' ?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
	<array><var name="XXXXXXXX"><boolean value="none">TEST</boolean></var>
		<var name="YYYYYYYY"><var name="ZZZZZZZZ"><var name="EZEZEZEZ">
		</var></var></var>
	</array>
</wddxPacket>
EOF;
$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
array(0) {
}
				if(!ent->data) {
					break;
				}
						ent->varname = NULL;
CVE-2016-5773 (C, published 2016-08-07T10:59Z)
Description: value: php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/php/php-src
Files changed:
ext/standard/tests/strings/bug72434.phpt
ext/zip/php_zip.c
Commit message: Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize


Vulnerable code:

Fixed code:
--TEST--
Bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize
--SKIPIF--
<?php
if(!class_exists('zip')) die('ZipArchive');
?>
--FILE--
<?php
// The following array will be serialized and this representation will be freed later on.
$free_me = array(new StdClass());
// Create our payload and unserialize it.
$serialized_payload = 'a:3:{i:1;N;i:2;O:10:"ZipArchive":1:{s:8:"filename";'.serialize($free_me).'}i:1;R:4;}';
$unserialized_payload = unserialize($serialized_payload);
gc_collect_cycles();
// The reference counter for $free_me is at -1 for PHP 7 right now.
// Increment the reference counter by 1 -> rc is 0
$a = $unserialized_payload[1];
// Increment the reference counter by 1 again -> rc is 1
$b = $a;
// Trigger free of $free_me (referenced by $m[1]).
unset($b);
$fill_freed_space_1 = "filler_zval_1";
$fill_freed_space_2 = "filler_zval_2";
$fill_freed_space_3 = "filler_zval_3";
$fill_freed_space_4 = "filler_zval_4";
debug_zval_dump($unserialized_payload[1]);
?>
--EXPECTF--
array(1) refcount(1){
  [0]=>
  object(stdClass)#%d (0) refcount(3){
  }
}
static HashTable *php_zip_get_gc(zval *object, zval ***gc_data, int *gc_data_count TSRMLS_DC) /* {{{ */
{
	*gc_data = NULL;
	*gc_data_count = 0;
	return zend_std_get_properties(object TSRMLS_CC);
}
/* }}} */

	zip_object_handlers.get_gc          = php_zip_get_gc;
CVE-2016-7125 (C, published 2016-09-12T01:59Z)
Description: value: ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/php/php-src
Files changed:
ext/session/session.c
ext/session/tests/bug72681.phpt
Commit message: Fix bug #72681 - consume data even if we're not storing them


Vulnerable code:
				efree(name);
				continue;
				php_set_session_var(name, namelen, current, &var_hash  TSRMLS_CC);
		PS_ADD_VARL(name, namelen);
				goto skip;
				php_set_session_var(name, namelen, current, &var_hash  TSRMLS_CC);
		PS_ADD_VARL(name, namelen);

Fixed code:
	int skip = 0;
		skip = 0;
				skip = 1;
				if (!skip) {
					php_set_session_var(name, namelen, current, &var_hash  TSRMLS_CC);
				}
		if (!skip) {
			PS_ADD_VARL(name, namelen);
		}
	int skip = 0;
		skip = 0;
				skip = 1;
				if (!skip) {
					php_set_session_var(name, namelen, current, &var_hash  TSRMLS_CC);
				}
		if (!skip) {
			PS_ADD_VARL(name, namelen);
		}
--TEST--
Bug #72681: PHP Session Data Injection Vulnerability
--SKIPIF--
<?php include('skipif.inc'); ?>
--FILE--
<?php
ini_set('session.serialize_handler', 'php');
session_start();
$_SESSION['_SESSION'] = 'ryat|O:8:"stdClass":0:{}';
session_write_close();
session_start();
var_dump($_SESSION);
?>
--EXPECT--
array(0) {
}
CVE-2016-7126 (C, published 2016-09-12T01:59Z)
Description: value: The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (select_colors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/php/php-src
Files changed:
ext/gd/gd.c
ext/gd/tests/bug72697.phpt
Commit message: Fix bug#72697 - select_colors write out-of-bounds

(cherry picked from commit b6f13a5ef9d6280cf984826a5de012a32c396cd4)

Conflicts:
	ext/gd/gd.c


Vulnerable code:
	if (ncolors <= 0) {
		php_error_docref(NULL, E_WARNING, "Number of colors has to be greater than zero");
	gdImageTrueColorToPalette(im, dither, ncolors);

Fixed code:
	if (ncolors <= 0 || ZEND_LONG_INT_OVFL(ncolors)) {
		php_error_docref(NULL, E_WARNING, "Number of colors has to be greater than zero and no more than %d", INT_MAX);
	gdImageTrueColorToPalette(im, dither, (int)ncolors);
--TEST--
Bug #72697: select_colors write out-of-bounds
--SKIPIF--
<?php 
if (!function_exists("imagecreatetruecolor")) die("skip");
if (PHP_INT_MAX !== 9223372036854775807) die("skip for 64-bit long systems only");
?>
--FILE--
<?php

$img=imagecreatetruecolor(10, 10);
imagetruecolortopalette($img, false, PHP_INT_MAX / 8);
?>
DONE
--EXPECTF--
Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than 2147483647 in %sbug72697.php on line %d
DONE
CVE-2016-7127 (C, published 2016-09-12T01:59Z)
Description: value: The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by providing different signs for the second and third arguments.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/php/php-src
Files changed:
ext/gd/gd.c
ext/gd/tests/bug72730.phpt
Commit message: Fix bug #72730 - imagegammacorrect allows arbitrary write access


Vulnerable code:

Fixed code:
	if ( input <= 0.0 || output <= 0.0 ) {
		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Gamma values should be positive");
		RETURN_FALSE;
	}

--TEST--
Bug #72730: imagegammacorrect allows arbitrary write access
--SKIPIF--
<?php 
if (!function_exists("imagecreatetruecolor")) die("skip");
?>
--FILE--
<?php
$img =  imagecreatetruecolor(1, 1);
imagegammacorrect($img, -1, 1337);
?>
DONE
--EXPECTF--
Warning: imagegammacorrect(): Gamma values should be positive in %sbug72730.php on line %d
DONE
CVE-2016-7128 (C, published 2016-09-12T01:59Z)
Description: value: The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/php/php-src
Files changed:
ext/exif/exif.c
ext/exif/tests/bug72627.phpt
Commit message: Fixed bug #72627: Memory Leakage In exif_process_IFD_in_TIFF


Vulnerable code:
						exif_thumbnail_build(ImageInfo TSRMLS_CC);

Fixed code:
							efree(ImageInfo->Thumbnail.data);
							ImageInfo->Thumbnail.data = NULL;
						} else {
							exif_thumbnail_build(ImageInfo TSRMLS_CC);
--TEST--
Bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF)
--SKIPIF--
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
<?php
	$exif = exif_read_data(__DIR__ . '/bug72627.tiff',0,0,true);
	var_dump($exif);
?>
--EXPECTF--
Warning: exif_read_data(%s): Thumbnail goes IFD boundary or end of file reached in %sbug72627.php on line %d

Warning: exif_read_data(%s): Error in TIFF: filesize(x04E2) less than start of IFD dir(x829A0004) in %sbug72627.php on line %d

Warning: exif_read_data(%s): Thumbnail goes IFD boundary or end of file reached in %sbug72627.php on line %d
array(11) {
  ["FileName"]=>
  string(13) "bug72627.tiff"
  ["FileDateTime"]=>
  int(%d)
  ["FileSize"]=>
  int(1250)
  ["FileType"]=>
  int(7)
  ["MimeType"]=>
  string(10) "image/tiff"
  ["SectionsFound"]=>
  string(30) "ANY_TAG, IFD0, THUMBNAIL, EXIF"
  ["COMPUTED"]=>
  array(10) {
    ["html"]=>
    string(24) "width="128" height="132""
    ["Height"]=>
    int(132)
    ["Width"]=>
    int(128)
    ["IsColor"]=>
    int(0)
    ["ByteOrderMotorola"]=>
    int(0)
    ["ApertureFNumber"]=>
    string(5) "f/1.0"
    ["Thumbnail.FileType"]=>
    int(2)
    ["Thumbnail.MimeType"]=>
    string(10) "image/jpeg"
    ["Thumbnail.Height"]=>
    int(132)
    ["Thumbnail.Width"]=>
    int(128)
  }
  ["XResolution"]=>
  string(21) "1414812756/1414812756"
  ["THUMBNAIL"]=>
  array(5) {
    ["ImageWidth"]=>
    int(128)
    ["ImageLength"]=>
    int(132)
    ["JPEGInterchangeFormat"]=>
    int(1280)
    ["JPEGInterchangeFormatLength"]=>
    int(100)
    ["THUMBNAIL"]=>
    NULL
  }
  ["ExposureTime"]=>
  string(21) "1414812756/1414812756"
  ["FNumber"]=>
  string(21) "1414812756/1414812756"
}