# heap-buffer-overflow (READ of size 48) in exif_read_data()

Crafted JPEG triggers heap-buffer-overflow READ in PHP's exif_read_data() via MakerNote IFD tag parsing, potentially leading to remote code execution.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: geeknik
- Disclosed: 2018-09-01
- CVE: CVE-2018-14851
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/384214
- Library page: https://bugbountylibrary.com/r/h1%3A384214
- Tags: area:oss domain:oss impact:dos impact:rce kind:bounty platform:hackerone sev:medium tech:php vuln:memory-corruption

**Target:** PHP exif extension (exif_read_data) parsing JPEG APP1/MakerNote IFD tags
**Root cause:** exif_process_IFD_TAG in MakerNote handling passes an attacker-controlled length to exif_iif_add_value/_estrndup without validating it against the actual buffer, causing an out-of-bounds read of 48 bytes.
**Steps:**
1. Craft a JPEG with an APP1 EXIF segment containing a MakerNote IFD tag whose declared length exceeds the available data.
2. Run `USE_ZEND_ALLOC=0 ./php-7.2.7 -r '$exif = exif_read_data("http://dtf.pw/php727/poc/630/test000.jpeg"); var_dump($exif);'`
3. Observe ASan heap-buffer-overflow READ of size 48 in __asan_memcpy via _estrndup -> exif_iif_add_value -> exif_iif_add_tag -> exif_process_IFD_TAG.
**Exploitation:** Attacker supplies a malicious JPEG to any service calling exif_read_data on uploaded images; the out-of-bounds read can crash the process and, per the report, potentially be leveraged for remote code execution.
**Insight:** MakerNote IFD tags are a recurring source of length-trust bugs in EXIF parsers; fuzz the MakerNote sub-IFD path specifically since its offsets/lengths are vendor-defined and often under-validated.