Red Hat Bugzilla – Bug 1374699
CVE-2016-7126 php: select_colors write out-of-bounds
Last modified: 2016-11-15 13:33:22 EST
The following flaw was found in PHP: Type mismatch parameters between ncolors and colorsWanted parameters at zif_imagetruecolortopalette and php_gd_gdImageTrueColorToPalette, ncolors is a 64 bit integer and colorsWanted is 32 bits, ncolors' value 0x1000000000000000 becomes 0 inside php_gd_gdImageTrueColorToPalette. A remote attacker could use this flaw to crash a PHP application. Upstream bug: https://bugs.php.net/bug.php?id=72697 Upstream patch: https://github.com/php/php-src/commit/b6f13a5ef9d6280cf984826a5de012a32c396cd4?w=1
Analysis: This is basically an integer-wrapping which occurs because of type mismatch. User passes integer to imagetruecolortopalette() as per documentation (http://php.net/manual/en/function.imagetruecolortopalette.php), however when this function internally calls gdImageTrueColorToPalette(), its parameter colorsWanted is 32 bit, which later leads to OOB write. To exploit this, the attacker needs to control the ncolors parameter in imagetruecolortopalette(), which is unlikely in case of an normal PHP application.
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html