CVE-2016-9933 (published 2017-01-04T20:59Z)

Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/php/php-src
commit_details: repo_url: https://github.com/php/php-src
author: Christoph M. Becker
author_date: 2016-10-25 13:23:16+02:00
msg: Fix #72696: imagefilltoborder stackoverflow on truecolor images

We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.
repository: repo_url: https://github.com/php/php-src
repo_name: php/php-src
description: The PHP Interpreter
repo_language: C
owner: php
file_changes: filename: gd.c
change_type: ModificationType.MODIFY
diff: @@ -1747,7 +1747,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 	int leftLimit = -1, rightLimit;
 	int i, restoreAlphaBlending = 0;
 
-	if (border < 0) {
+	if (border < 0 || color < 0) {
 		/* Refuse to fill to a non-solid border */
 		return;
 	}

programming_language: C
filename: bug72696.phpt
change_type: ModificationType.ADD
diff: @@ -0,0 +1,14 @@
+--TEST--
+Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(10, 10);
+imagefilltoborder($im, 0, 0, 1, -2);
+?>
+===DONE===
+--EXPECT--
+===DONE===

programming_language: PHP
repo_url: https://github.com/libgd/libgd
commit_details: repo_url: https://github.com/libgd/libgd
author: Pierre Joye
author_date: 2016-06-04 23:09:01+07:00
msg: fix #215 gdImageFillToBorder stack-overflow when invalid color is used
repository: repo_url: https://github.com/libgd/libgd
repo_name: libgd/libgd
description: GD Graphics Library
repo_language: C
owner: libgd
file_changes: filename: gd.c
change_type: ModificationType.MODIFY
diff: @@ -1928,11 +1928,17 @@ BGD_DECLARE(void) gdImageFillToBorder (gdImagePtr im, int x, int y, int border,
 	int i;
 	int restoreAlphaBleding;
 
-	if (border < 0) {
+	if (border < 0 || color < 0) {
 		/* Refuse to fill to a non-solid border */
 		return;
 	}
 
+	if (!im->trueColor) {
+		if ((color > (im->colorsTotal - 1)) || (border > (im->colorsTotal - 1))) {
+			return;
+		}
+    }
+
 	leftLimit = (-1);
 
 	restoreAlphaBleding = im->alphaBlendingFlag;

programming_language: C
filename: .gitignore
change_type: ModificationType.MODIFY
diff: @@ -1 +1,2 @@
 /bug00037
+/github_bug_215

programming_language: Batchfile
filename: CMakeLists.txt
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,6 @@
 SET(TESTS_FILES
 	bug00037
+	github_bug_215
 )
 
 ADD_GD_TESTS()

programming_language: Batchfile
filename: Makemodule.am
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 if HAVE_LIBPNG
 libgd_test_programs += \
-	gdimagefilltoborder/bug00037
+	gdimagefilltoborder/bug00037 \
+	gdimagefilltoborder/github_bug_215
 endif
 
 EXTRA_DIST += \

programming_language: Batchfile