Skip to content

ext/gd: fix undefined behavior with GIFs with problematic LZW compression data - #23954

Merged
DanielEScherzer merged 2 commits into
php:PHP-8.4from
DanielEScherzer:gif-oob-read
Sep 30, 2026
Merged

DanielEScherzer merged 2 commits into
php:PHP-8.4from
DanielEScherzer:gif-oob-read

Conversation

@DanielEScherzer

Copy link
Copy Markdown
Member

Apply the changes from libgd/libgd@9fa3abd in order to fix undefined behavior from out-of-bounds reads when creating a GIF with problematic LZW compression data.

@DanielEScherzer

Copy link
Copy Markdown
Member Author

This is only needed for PHP 8.4 and 8.5, 8.6 included the fix as part of #22532

Without this fix, UBSAN_OPTIONS=print_stacktrace=1 /usr/src/php84/sapi/cli/php /var/www/html/gd.php results in

/usr/src/php84/ext/gd/libgd/gd_gif_in.c:520:16: runtime error: index 8191 out of bounds for type 'int[4096]'
    #0 0x565139ecd914 in LWZReadByte_ /usr/src/php84/ext/gd/libgd/gd_gif_in.c:520:16
    #1 0x565139eca615 in LWZReadByte /usr/src/php84/ext/gd/libgd/gd_gif_in.c:554:7
    #2 0x565139ec9f52 in ReadImage /usr/src/php84/ext/gd/libgd/gd_gif_in.c:604:14
    #3 0x565139ec87dd in php_gd_gdImageCreateFromGifCtx /usr/src/php84/ext/gd/libgd/gd_gif_in.c:252:4
    #4 0x565139e55485 in _php_image_create_from_string /usr/src/php84/ext/gd/gd.c:1448:7
    #5 0x565139e54591 in zif_imagecreatefromstring /usr/src/php84/ext/gd/gd.c:1494:9
    #6 0x56513b70635d in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /usr/src/php84/Zend/zend_vm_execute.h:1351:2
    #7 0x56513b35e20f in execute_ex /usr/src/php84/Zend/zend_vm_execute.h:58697:7
    #8 0x56513b35ef7e in zend_execute /usr/src/php84/Zend/zend_vm_execute.h:64349:2
    #9 0x56513bc567e8 in zend_execute_script /usr/src/php84/Zend/zend.c:1937:3
    #10 0x56513ac3824d in php_execute_script_ex /usr/src/php84/main/main.c:2577:13
    #11 0x56513ac38978 in php_execute_script /usr/src/php84/main/main.c:2617:9
    #12 0x56513bc602a9 in do_cli /usr/src/php84/sapi/cli/php_cli.c:935:5
    #13 0x56513bc5dfc5 in main /usr/src/php84/sapi/cli/php_cli.c:1322:18
    #14 0x7f259e0b6249 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #15 0x7f259e0b6304 in __libc_start_main csu/../csu/libc-start.c:360:3
    #16 0x565139403f30 in _start (/usr/src/php84/sapi/cli/php+0x1a03f30) (BuildId: 19ac90755960f95b5e2d9b45f49a35be7b83f33d)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /usr/src/php84/ext/gd/libgd/gd_gif_in.c:520:16 in

@DanielEScherzer DanielEScherzer changed the title Port libgd 9fa3abd2e61da18ed2b889704e4e252f0f5a95fe to fix undefined behavior ext/gd: fix undefined behavior with GIFs with problematic LZW compression data Sep 28, 2026
@DanielEScherzer

Copy link
Copy Markdown
Member Author

@vapier as the original author of the fix, I've included your GitHub username in the credits in the NEWS entry:

Fixed undefined behavior with GIFs with problematic LZW compression data.
(DanielEScherzer, vapier)

please let me know if you would like to be credited under a different name

@vapier

vapier commented Sep 29, 2026

Copy link
Copy Markdown

I'm fairly indifferent. thanks for checking.

…sion data

Apply the changes from libgd/libgd@9fa3abd in
order to fix undefined behavior from out-of-bounds reads when creating a GIF
with problematic LZW compression data.
@DanielEScherzer
DanielEScherzer merged commit c8d62b8 into php:PHP-8.4 Sep 30, 2026
17 of 18 checks passed
@DanielEScherzer
DanielEScherzer deleted the gif-oob-read branch September 30, 2026 01:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants