3 ms·
Curious if this affects PHP. AFAIKT GD is compiled with libpng for PHP (it's required) and is presumably used for functions like getimagesize() in PHP. That is
by mmaunder 11y ago
Curious if this affects PHP. AFAIKT GD is compiled with libpng for PHP (it's required) and is presumably used for functions like getimagesize() in PHP. That is used by WordPress core for uploads (although you need to be signed in). However I suspect many plugins use GD for unauthenticated image upload, so this could have a wide impact.
- kalleboo 11y agoIf I'm reading this comment https://news.ycombinator.com/item?id=10567353 https://news.ycombinator.com/item?id=10567353 and this code https://github.com/libgd/libgd/blob/4751b606fa38edc456d627140898a7ec679fcc24/src/gd_png.c https://github.com/libgd/libgd/blob/4751b606fa38edc456d62714... correctly, then it looks like GD isn't vulnerable since it uses num_palette to size the palette rather than info_ptr->palette or bit_depth