Skip to content

Commit bda1cc6

Browse files
kaplanliorkaplanlior
committed
Bug #67730: Add tests by Ryan Mauger <ryan@rmauger.co.uk>
1 parent cb41a7b commit bda1cc6

7 files changed

+252
-0
lines changed

‎ext/gd/tests/imagegd2_nullbyte_injection.phpt

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
--TEST--
2+
Testing null byte injection in imagegd2
3+
--CLEAN--
4+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
5+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
6+
rmdir($tempdir);
7+
--FILE--
8+
<?php
9+
$image = imagecreate(1,1);// 1px image
10+
11+
12+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
13+
if (!file_exists($tempdir) && !is_dir($tempdir)) {
14+
mkdir ($tempdir, 0777, true);
15+
}
16+
17+
$userinput = "1\0"; // from post or get data
18+
$temp = $tempdir. "/test" . $userinput .".tmp";
19+
20+
echo "\nimagegd2 TEST\n";
21+
imagegd2($image, $temp);
22+
var_dump(file_exists($tempdir. "/test1"));
23+
var_dump(file_exists($tempdir. "/test1.tmp"));
24+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
25+
26+
--EXPECTF--
27+
imagegd2 TEST
28+
29+
Warning: imagegd2() expects parameter 2 to be a valid path, string given in %s on line %d
30+
bool(false)
31+
bool(false)

‎ext/gd/tests/imagegd_nullbyte_injection.phpt

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
--TEST--
2+
Testing null byte injection in imagegd
3+
--CLEAN--
4+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
5+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
6+
rmdir($tempdir);
7+
--FILE--
8+
<?php
9+
$image = imagecreate(1,1);// 1px image
10+
11+
12+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
13+
if (!file_exists($tempdir) && !is_dir($tempdir)) {
14+
mkdir ($tempdir, 0777, true);
15+
}
16+
17+
$userinput = "1\0"; // from post or get data
18+
$temp = $tempdir. "/test" . $userinput .".tmp";
19+
20+
echo "\nimagegd TEST\n";
21+
imagegd($image, $temp);
22+
var_dump(file_exists($tempdir. "/test1"));
23+
var_dump(file_exists($tempdir. "/test1.tmp"));
24+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
25+
26+
--EXPECTF--
27+
imagegd TEST
28+
29+
Warning: imagegd() expects parameter 2 to be a valid path, string given in %s on line %d
30+
bool(false)
31+
bool(false)

‎ext/gd/tests/imagegif_nullbyte_injection.phpt

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
Testing null byte injection in imagegif
3+
--CLEAN--
4+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
5+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
6+
rmdir($tempdir);
7+
--SKIPIF--
8+
<?php
9+
$support = gd_info();
10+
if (!isset($support['GIF Create Support']) || $support['GIF Create Support'] === false) {
11+
print 'skip gif support not available';
12+
}
13+
?>
14+
--FILE--
15+
<?php
16+
$image = imagecreate(1,1);// 1px image
17+
18+
19+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
20+
if (!file_exists($tempdir) && !is_dir($tempdir)) {
21+
mkdir ($tempdir, 0777, true);
22+
}
23+
24+
$userinput = "1\0"; // from post or get data
25+
$temp = $tempdir. "/test" . $userinput .".tmp";
26+
27+
echo "\nimagegif TEST\n";
28+
imagegif($image, $temp);
29+
var_dump(file_exists($tempdir. "/test1"));
30+
var_dump(file_exists($tempdir. "/test1.tmp"));
31+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
32+
33+
--EXPECTF--
34+
imagegif TEST
35+
36+
Warning: imagegif(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
37+
bool(false)
38+
bool(false)

‎ext/gd/tests/imagejpeg_nullbyte_injection.phpt

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
Testing null byte injection in imagejpeg
3+
--CLEAN--
4+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
5+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
6+
rmdir($tempdir);
7+
--SKIPIF--
8+
<?php
9+
$support = gd_info();
10+
if (!isset($support['JPEG Support']) || $support['JPEG Support'] === false) {
11+
print 'skip jpeg support not available';
12+
}
13+
?>
14+
--FILE--
15+
<?php
16+
$image = imagecreate(1,1);// 1px image
17+
18+
19+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
20+
if (!file_exists($tempdir) && !is_dir($tempdir)) {
21+
mkdir ($tempdir, 0777, true);
22+
}
23+
24+
$userinput = "1\0"; // from post or get data
25+
$temp = $tempdir. "/test" . $userinput .".tmp";
26+
27+
echo "\nimagejpeg TEST\n";
28+
imagejpeg($image, $temp);
29+
var_dump(file_exists($tempdir. "/test1"));
30+
var_dump(file_exists($tempdir. "/test1.tmp"));
31+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
32+
33+
--EXPECTF--
34+
imagejpeg TEST
35+
36+
Warning: imagejpeg(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
37+
bool(false)
38+
bool(false)

‎ext/gd/tests/imagepng_nullbyte_injection.phpt

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
Testing null byte injection in imagepng
3+
--CLEAN--
4+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
5+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
6+
rmdir($tempdir);
7+
--SKIPIF--
8+
<?php
9+
$support = gd_info();
10+
if (!isset($support['PNG Support']) || $support['PNG Support'] === false) {
11+
print 'skip png support not available';
12+
}
13+
?>
14+
--FILE--
15+
<?php
16+
$image = imagecreate(1,1);// 1px image
17+
18+
19+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
20+
if (!file_exists($tempdir) && !is_dir($tempdir)) {
21+
mkdir ($tempdir, 0777, true);
22+
}
23+
24+
$userinput = "1\0"; // from post or get data
25+
$temp = $tempdir. "/test" . $userinput .".tmp";
26+
27+
echo "\nimagepng TEST\n";
28+
imagepng($image, $temp);
29+
var_dump(file_exists($tempdir. "/test1"));
30+
var_dump(file_exists($tempdir. "/test1.tmp"));
31+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
32+
33+
--EXPECTF--
34+
imagepng TEST
35+
36+
Warning: imagepng(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
37+
bool(false)
38+
bool(false)

‎ext/gd/tests/imagewbmp_nullbyte_injection.phpt

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
Testing null byte injection in imagewbmp
3+
--CLEAN--
4+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
5+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
6+
rmdir($tempdir);
7+
--SKIPIF--
8+
<?php
9+
$support = gd_info();
10+
if (!isset($support['WBMP Support']) || $support['WBMP Support'] === false) {
11+
print 'skip wbmp support not available';
12+
}
13+
?>
14+
--FILE--
15+
<?php
16+
$image = imagecreate(1,1);// 1px image
17+
18+
19+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
20+
if (!file_exists($tempdir) && !is_dir($tempdir)) {
21+
mkdir ($tempdir, 0777, true);
22+
}
23+
24+
$userinput = "1\0"; // from post or get data
25+
$temp = $tempdir. "/test" . $userinput .".tmp";
26+
27+
echo "\nimagewbmp TEST\n";
28+
imagewbmp($image, $temp);
29+
var_dump(file_exists($tempdir. "/test1"));
30+
var_dump(file_exists($tempdir. "/test1.tmp"));
31+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
32+
33+
--EXPECTF--
34+
imagewbmp TEST
35+
36+
Warning: imagewbmp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
37+
bool(false)
38+
bool(false)

‎ext/gd/tests/imagewebp_nullbyte_injection.phpt

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
Testing null byte injection in imagewebp
3+
--CLEAN--
4+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
5+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
6+
rmdir($tempdir);
7+
--SKIPIF--
8+
<?php
9+
$support = gd_info();
10+
if (!isset($support['WEBP Support']) || $support['WEBP Support'] === false) {
11+
print 'skip webp support not available';
12+
}
13+
?>
14+
--FILE--
15+
<?php
16+
$image = imagecreate(1,1);// 1px image
17+
18+
19+
$tempdir = sys_get_temp_dir(). '/php-gdtest';
20+
if (!file_exists($tempdir) && !is_dir($tempdir)) {
21+
mkdir ($tempdir, 0777, true);
22+
}
23+
24+
$userinput = "1\0"; // from post or get data
25+
$temp = $tempdir. "/test" . $userinput .".tmp";
26+
27+
echo "\nimagewebp TEST\n";
28+
imagewebp($image, $temp);
29+
var_dump(file_exists($tempdir. "/test1"));
30+
var_dump(file_exists($tempdir. "/test1.tmp"));
31+
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
32+
33+
--EXPECTF--
34+
imagewbmp TEST
35+
36+
Warning: imagewebp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
37+
bool(false)
38+
bool(false)

0 commit comments

Comments
 (0)