This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Copyright (c) 2011, oov. All rights reserved. |
||
4 | * |
||
5 | * Redistribution and use in source and binary forms, with or without modification, |
||
6 | * are permitted provided that the following conditions are met: |
||
7 | * |
||
8 | * - Redistributions of source code must retain the above copyright notice, |
||
9 | * this list of conditions and the following disclaimer. |
||
10 | * - Redistributions in binary form must reproduce the above copyright notice, |
||
11 | * this list of conditions and the following disclaimer in the documentation |
||
12 | * and/or other materials provided with the distribution. |
||
13 | * - Neither the name of the oov nor the names of its contributors may be used to |
||
14 | * endorse or promote products derived from this software without specific prior |
||
15 | * written permission. |
||
16 | * |
||
17 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND |
||
18 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
||
19 | * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
||
20 | * IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, |
||
21 | * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, |
||
22 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, |
||
23 | * OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, |
||
24 | * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
||
25 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
||
26 | * POSSIBILITY OF SUCH DAMAGE. |
||
27 | * |
||
28 | * bmp ファイルを GD で使えるように |
||
29 | * |
||
30 | * 使用例: |
||
31 | * //ファイルから読み込む場合はGDでPNGなどを読み込むのと同じような方法で可 |
||
32 | * $image = imagecreatefrombmp("test.bmp"); |
||
33 | * imagedestroy($image); |
||
34 | * |
||
35 | * //文字列から読み込む場合は以下の方法で可 |
||
36 | * $image = GdBmp::loadFromString(file_get_contents("test.bmp")); |
||
37 | * //自動判定されるので破損ファイルでなければこれでも上手くいく |
||
38 | * //$image = imagecreatefrombmp(file_get_contents("test.bmp")); |
||
39 | * imagedestroy($image); |
||
40 | * |
||
41 | * //その他任意のストリームからの読み込みも可能 |
||
42 | * $stream = fopen("http://127.0.0.1/test.bmp"); |
||
43 | * $image = GdBmp::loadFromStream($stream); |
||
44 | * //自動判定されるのでこれでもいい |
||
45 | * //$image = imagecreatefrombmp($stream); |
||
46 | * fclose($stream); |
||
47 | * imagedestroy($image); |
||
48 | * |
||
49 | * 対応フォーマット |
||
50 | * 1bit |
||
51 | * 4bit |
||
52 | * 4bitRLE |
||
53 | * 8bit |
||
54 | * 8bitRLE |
||
55 | * 16bit(任意のビットフィールド) |
||
56 | * 24bit |
||
57 | * 32bit(任意のビットフィールド) |
||
58 | * BITMAPINFOHEADER の biCompression が BI_PNG / BI_JPEG の画像 |
||
59 | * すべての形式でトップダウン/ボトムアップの両方をサポート |
||
60 | * 特殊なビットフィールドでもビットフィールドデータが正常なら読み込み可能 |
||
61 | * |
||
62 | * 以下のものは非対応 |
||
63 | * BITMAPV4HEADER と BITMAPV5HEADER に含まれる色空間に関する様� |
||
64 | * な機能 |
||
65 | * @param $filename_or_stream_or_binary |
||
66 | * @return bool|resource |
||
67 | */ |
||
68 | function imagecreatefrombmp($filename_or_stream_or_binary) |
||
69 | { |
||
70 | return elFinderLibGdBmp::load($filename_or_stream_or_binary); |
||
71 | } |
||
72 | |||
73 | class elFinderLibGdBmp |
||
0 ignored issues
–
show
|
|||
74 | { |
||
75 | public static function load($filename_or_stream_or_binary) |
||
76 | { |
||
77 | if (is_resource($filename_or_stream_or_binary)) { |
||
78 | return self::loadFromStream($filename_or_stream_or_binary); |
||
79 | } elseif (is_string($filename_or_stream_or_binary) && strlen($filename_or_stream_or_binary) >= 26) { |
||
80 | $bfh = unpack('vtype/Vsize', $filename_or_stream_or_binary); |
||
81 | if ($bfh['type'] == 0x4d42 && ($bfh['size'] == 0 || $bfh['size'] == strlen($filename_or_stream_or_binary))) { |
||
82 | return self::loadFromString($filename_or_stream_or_binary); |
||
83 | } |
||
84 | } |
||
85 | |||
86 | return self::loadFromFile($filename_or_stream_or_binary); |
||
87 | } |
||
88 | |||
89 | public static function loadFromFile($filename) |
||
90 | { |
||
91 | $fp = fopen($filename, 'rb'); |
||
92 | if ($fp === false) { |
||
93 | return false; |
||
94 | } |
||
95 | |||
96 | $bmp = self::loadFromStream($fp); |
||
97 | |||
98 | fclose($fp); |
||
99 | |||
100 | return $bmp; |
||
101 | } |
||
102 | |||
103 | public static function loadFromString($str) |
||
104 | { |
||
105 | //data scheme より古いバージョンから対応しているようなので php://memory を使う |
||
106 | $fp = fopen('php://memory', 'r+b'); |
||
107 | if ($fp === false) { |
||
108 | return false; |
||
109 | } |
||
110 | |||
111 | if (fwrite($fp, $str) != strlen($str)) { |
||
112 | fclose($fp); |
||
113 | |||
114 | return false; |
||
115 | } |
||
116 | |||
117 | if (fseek($fp, 0) === -1) { |
||
118 | fclose($fp); |
||
119 | |||
120 | return false; |
||
121 | } |
||
122 | |||
123 | $bmp = self::loadFromStream($fp); |
||
124 | |||
125 | fclose($fp); |
||
126 | |||
127 | return $bmp; |
||
128 | } |
||
129 | |||
130 | public static function loadFromStream($stream) |
||
131 | { |
||
132 | $buf = fread($stream, 14); //2+4+2+2+4 |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
56% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
133 | if ($buf === false) { |
||
134 | return false; |
||
135 | } |
||
136 | |||
137 | //シグネチャチェック |
||
138 | if ($buf[0] != 'B' || $buf[1] != 'M') { |
||
139 | return false; |
||
140 | } |
||
141 | |||
142 | $bitmap_file_header = unpack( |
||
143 | //BITMAPFILEHEADER構造体 |
||
144 | 'vtype/'. |
||
145 | 'Vsize/'. |
||
146 | 'vreserved1/'. |
||
147 | 'vreserved2/'. |
||
148 | 'Voffbits', $buf |
||
149 | ); |
||
150 | |||
151 | return self::loadFromStreamAndFileHeader($stream, $bitmap_file_header); |
||
152 | } |
||
153 | |||
154 | public static function loadFromStreamAndFileHeader($stream, array $bitmap_file_header) |
||
155 | { |
||
156 | if ($bitmap_file_header['type'] != 0x4d42) { |
||
157 | return false; |
||
158 | } |
||
159 | |||
160 | //情報ヘッダサイズを元に形式を区別して読み込み |
||
161 | $buf = fread($stream, 4); |
||
162 | if ($buf === false) { |
||
163 | return false; |
||
164 | } |
||
165 | list(, $header_size) = unpack('V', $buf); |
||
166 | |||
167 | if ($header_size == 12) { |
||
168 | $buf = fread($stream, $header_size - 4); |
||
169 | if ($buf === false) { |
||
170 | return false; |
||
171 | } |
||
172 | |||
173 | extract(unpack( |
||
0 ignored issues
–
show
|
|||
174 | //BITMAPCOREHEADER構造体 - OS/2 Bitmap |
||
175 | 'vwidth/'. |
||
176 | 'vheight/'. |
||
177 | 'vplanes/'. |
||
178 | 'vbit_count', $buf |
||
179 | )); |
||
180 | //飛んでこない分は 0 で初期化しておく |
||
181 | $clr_used = $clr_important = $alpha_mask = $compression = 0; |
||
0 ignored issues
–
show
$clr_important is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
182 | |||
183 | //マスク類は初期化されないのでここで割り当てておく |
||
184 | $red_mask = 0x00ff0000; |
||
185 | $green_mask = 0x0000ff00; |
||
186 | $blue_mask = 0x000000ff; |
||
187 | } elseif (124 < $header_size || $header_size < 40) { |
||
188 | //未知の形式 |
||
189 | return false; |
||
190 | } else { |
||
191 | //この時点で36バイト読めることまではわかっている |
||
192 | $buf = fread($stream, 36); //既に読んだ部分は除外しつつBITMAPINFOHEADERのサイズだけ読む |
||
193 | if ($buf === false) { |
||
194 | return false; |
||
195 | } |
||
196 | |||
197 | //BITMAPINFOHEADER構造体 - Windows Bitmap |
||
198 | extract(unpack( |
||
0 ignored issues
–
show
|
|||
199 | 'Vwidth/'. |
||
200 | 'Vheight/'. |
||
201 | 'vplanes/'. |
||
202 | 'vbit_count/'. |
||
203 | 'Vcompression/'. |
||
204 | 'Vsize_image/'. |
||
205 | 'Vx_pels_per_meter/'. |
||
206 | 'Vy_pels_per_meter/'. |
||
207 | 'Vclr_used/'. |
||
208 | 'Vclr_important', $buf |
||
209 | )); |
||
210 | //負の整数を受け取る可能性があるものは自前で変換する |
||
211 | if ($width & 0x80000000) { |
||
212 | $width = -(~$width & 0xffffffff) - 1; |
||
213 | } |
||
214 | if ($height & 0x80000000) { |
||
215 | $height = -(~$height & 0xffffffff) - 1; |
||
216 | } |
||
217 | if ($x_pels_per_meter & 0x80000000) { |
||
218 | $x_pels_per_meter = -(~$x_pels_per_meter & 0xffffffff) - 1; |
||
0 ignored issues
–
show
$x_pels_per_meter is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
219 | } |
||
220 | if ($y_pels_per_meter & 0x80000000) { |
||
221 | $y_pels_per_meter = -(~$y_pels_per_meter & 0xffffffff) - 1; |
||
0 ignored issues
–
show
$y_pels_per_meter is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
222 | } |
||
223 | |||
224 | //ファイルによっては BITMAPINFOHEADER のサイズがおかしい(書き込み間違い?)ケースがある |
||
225 | //自分でファイルサイズを元に逆算することで回避できることもあるので再計算できそうなら正当性を調べる |
||
226 | //シークできないストリームの場合全体のファイルサイズは取得できないので、$bitmap_file_headerにサイズ申告がなければやらない |
||
227 | if ($bitmap_file_header['size'] != 0) { |
||
228 | $colorsize = $bit_count == 1 || $bit_count == 4 || $bit_count == 8 ? ($clr_used ? $clr_used : pow(2, $bit_count)) << 2 : 0; |
||
229 | $bodysize = $size_image ? $size_image : ((($width * $bit_count + 31) >> 3) & ~3) * abs($height); |
||
230 | $calcsize = $bitmap_file_header['size'] - $bodysize - $colorsize - 14; |
||
231 | |||
232 | //本来であれば一致するはずなのに合わない時は、値がおかしくなさそうなら(BITMAPV5HEADERの範囲内なら)計算して求めた値を採用する |
||
233 | if ($header_size < $calcsize && 40 <= $header_size && $header_size <= 124) { |
||
234 | $header_size = $calcsize; |
||
235 | } |
||
236 | } |
||
237 | |||
238 | //BITMAPV4HEADER や BITMAPV5HEADER の場合まだ読むべきデータが残っている可能性がある |
||
239 | if ($header_size - 40 > 0) { |
||
240 | $buf = fread($stream, $header_size - 40); |
||
241 | if ($buf === false) { |
||
242 | return false; |
||
243 | } |
||
244 | |||
245 | extract(unpack( |
||
0 ignored issues
–
show
|
You can fix this by adding a namespace to your class:
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.