diff options
| author | Stanislav Malyshev <stas@php.net> | 2015-03-17 17:04:57 -0700 |
|---|---|---|
| committer | Ferenc Kovacs <tyrael@php.net> | 2015-03-19 00:42:12 +0100 |
| commit | 5fd617f2f5afa3a687969e7844864e027f97d964 (patch) | |
| tree | e4f61ff8a9f5ed46f9f168aa1a3f9ef3fd191207 | |
| parent | 7f183044fd301ed75f37983b95903b71467c29f4 (diff) | |
| download | php-git-5fd617f2f5afa3a687969e7844864e027f97d964.tar.gz | |
Fix bug #69248 - heap overflow vulnerability in regcomp.c
Merged from https://github.com/garyhouston/regex/commit/70bc2965604b6b8aaf260049e64c708dddf85334
| -rw-r--r-- | ext/ereg/regex/regcomp.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/ext/ereg/regex/regcomp.c b/ext/ereg/regex/regcomp.c index 156eee9329..f4bfc1c167 100644 --- a/ext/ereg/regex/regcomp.c +++ b/ext/ereg/regex/regcomp.c @@ -117,7 +117,15 @@ int cflags; (NC-1)*sizeof(cat_t)); if (g == NULL) return(REG_ESPACE); - p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */ + { + /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */ + size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */ + if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) { + free((char *) g); + return REG_INVARG; + } + p->ssize = new_ssize; + } p->strip = (sop *)malloc(p->ssize * sizeof(sop)); p->slen = 0; if (p->strip == NULL) { |