ext/standard: getimagesizefromstring() overflow.

Author: devnexen

ext/standard/image.c

@@ -871,7 +871,7 @@ static struct gfxinfo *php_handle_iff(php_stream * stream)
 		}
 		chunkId = php_ifd_get32s(a+0, 1);
 		size    = php_ifd_get32s(a+4, 1);
-		if (size < 0) {
+		if (size < 0 || size == INT_MAX) {
 			return NULL;
 		}
 		if ((size & 1) == 1) {

ext/standard/tests/image/getimagesizefromstring_iff_overflow.phpt

@@ -0,0 +1,14 @@
+--TEST--
+getimagesizefromstring() IFF chunk size integer overflow (GH-getimagesize_oflow)
+--CREDITS--
+Alexandre Daubois
+--FILE--
+<?php
+// IFF/ILBM with a chunk size of INT_MAX (0x7fffffff), an odd value.
+// The parser rounds odd chunk sizes up to even via size++, which overflowed
+// when size == INT_MAX. It must be handled gracefully rather than triggering UB.
+$payload = "FORM" . "\x00\x00\x00\x00" . "ILBM" . "ABCD" . "\x7f\xff\xff\xff";
+var_dump(getimagesizefromstring($payload));
+?>
+--EXPECT--
+bool(false)