 pHp GD Graphics Library integer overflow Hiya
An ANSI C library for the dynamic creation of images. GD creates PNG, JPEG and GIF images, among other formats. It is the library used by PHP to manipulate images.
There is an integer overflow when allocating memory in the routine that handles loading PNG image files. This later leads to heap data structures being overwritten. If an attacker tricked a user into loading a malicious PNG image, they could leverage this into executing arbitrary code in the context of the user opening image. Many programs use GD, such as ImageMagick, and more importantly it is also the image library used for PHP, and there is a Perl module as well. One possibile target would be PHP driven photo websites that let users upload images. Some of them will resize/compress the image when the user uploads them. If this is done using GD, this could be used to execute code on the server. There is a mitigating factor, in order to reach the vulnerable code, a large amount of memory needs to be allocated.
The vulnerable code occurs in the file gd_png.c, in the function
gdImageCreateFromPngCtx(), which is called by gdImageCreateFromPng().
This is in the latest version of pHp, and has been reported to the programmer, who is looking at updating.
*As I'm on a mailing list for Bugtraq, this is one of the emails*
Regards
eddie
__________________
Just go with the flow, like a twig on the shoulders of a mighty stream
Last edited by eddie5659 : 05-Nov-2004 05:47 AM.
| 
Congratulations to AcaCandy on her 100,000th post!
Software Development 
