Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Beta Programs
BugTraq
Name:
Email:
*Note: Email address will appear as "user domain ext" to prevent harvesting.
Subject:
Message:
 
PHP <= 5.2.1 wbmp file handling integer overflow Apr 07 2007 10:10AM
Ivan Fratric (ifsecure gmail com)
There is an integer overflow in PHP in ext/gd/libgd/wbmp.c in the
function readwbmp. If large enough values are specified for wbmp image
height and/or width, so that width*height > 2^32, an integer overflow
occurs on the following line

if ((wbmp->bitmap = (int *) safe_emalloc(wbmp->width * wbmp->he...

[ more ]  




 

Privacy Statement
Copyright 2009, SecurityFocus