# Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c

Integer overflow in PHP exif_thumbnail_extract on 32-bit systems lets a crafted JPEG bypass a length check and trigger a heap buffer overflow in estrndup.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: md4
- Disclosed: 2019-10-21
- CVE: CVE-2018-14883
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/384477
- Library page: https://bugbountylibrary.com/r/h1%3A384477
- Tags: area:oss domain:oss impact:data-leak impact:dos kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:memory-corruption

**Target:** PHP exif extension (exif_read_data) parsing JPEG/TIFF thumbnail metadata
**Root cause:** ImageInfo->Thumbnail.offset (up to 0xffffffff) plus Thumbnail.size (up to 0xffff) overflows a 32-bit int, so the `(offset + size) > length` bounds check is bypassed before estrndup copies size bytes from an out-of-range offset.
**Steps:**
1. Craft a JPEG with an EXIF/TIFF IFD thumbnail whose offset is near 0xffffffff and size up to 0xffff so offset+size wraps past the length check.
2. Run on a 32-bit PHP build with ASAN: `USE_ZEND_ALLOC=0 php IDF_tag.php` calling `exif_read_data` on the file.
3. Observe ASAN heap-buffer-overflow READ of size 65535 in _estrndup called from exif_thumbnail_extract (exif.c:2951).
**How found:** Code review of the thumbnail bounds check in exif.c:2947 noticing that offset and size are attacker-controlled and their sum can wrap a 32-bit int, then building a test JPEG to confirm under ASAN.
**Exploitation:** Attacker supplies a malicious image to any PHP app calling exif_read_data on 32-bit systems; the overflowed bounds check lets estrndup read up to 64KB out of bounds, leaking heap memory or crashing the process.
**Escalation:** Out-of-bounds read could leak sensitive environment data or cause segfaults, usable as a primitive in a larger exploit chain toward code execution.
**Insight:** When auditing length/bounds checks, look for additions of two attacker-controlled fields before comparison on 32-bit builds; offset+size sums are classic wrap points that bypass `> length` guards feeding memcpy/estrndup.