Internet Bug Bounty · Report #152784
imagegif/output out-of-bounds access
Validstatus
$500bounty
1upvotes
13 Oct 2019disclosed
How it was found
Bug https://bugs.php.net/bug.php?id=72519
Summary output function from gd_gif_out.c causes out-of-bounds access of the masks array when ctx->cur_bits becomes a negative number while generating a gif file.
Reported to PHP 2016-06-30 04:10 UTC
Patch 2016-07-19 07:47 UTC http://git.php.net/?p=php-src.git;a=commit;h=8dc5ffa479f886fae235d4ff6391e14546a3fda9
Fixed for PHP 5.5 (security only mode), PHP 5.6, PHP 7.0 http://php.net/ChangeLog-5.php http://php.net/ChangeLog-7.php