diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-11-26 14:48:40 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2016-11-26 14:48:40 -0800 |
| commit | 58cdd03d9267db3ee62a084492af3cdd12b86cdc (patch) | |
| tree | 9d36cc5b0e2079bde1dfcc0f6f1acc9facfdcb74 | |
| parent | 003727d851da770c60555a2aecf6d82497b04f42 (diff) | |
| parent | 5ee02b207d95dcddb0401a13773e17cfaaa18e95 (diff) | |
| download | php-git-58cdd03d9267db3ee62a084492af3cdd12b86cdc.tar.gz | |
Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
Add more mbfl string size checks (bug #73505)
| -rw-r--r-- | ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c | 28 | ||||
| -rw-r--r-- | ext/standard/string.c | 2 |
2 files changed, 28 insertions, 2 deletions
diff --git a/ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c b/ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c index 29782f5931..c4d4e7fe37 100644 --- a/ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c +++ b/ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c @@ -146,6 +146,10 @@ mbfl_memory_device_output(int c, void *data) unsigned char *tmp; newlen = device->length + device->allocsz; + if (newlen <= 0) { + /* overflow */ + return -1; + } tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char)); if (tmp == NULL) { return -1; @@ -169,6 +173,10 @@ mbfl_memory_device_output2(int c, void *data) unsigned char *tmp; newlen = device->length + device->allocsz; + if (newlen <= 0) { + /* overflow */ + return -1; + } tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char)); if (tmp == NULL) { return -1; @@ -194,6 +202,10 @@ mbfl_memory_device_output4(int c, void* data) unsigned char *tmp; newlen = device->length + device->allocsz; + if (newlen <= 0) { + /* overflow */ + return -1; + } tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char)); if (tmp == NULL) { return -1; @@ -227,6 +239,10 @@ mbfl_memory_device_strcat(mbfl_memory_device *device, const char *psrc) if ((device->pos + len) >= device->length) { /* reallocate buffer */ int newlen = device->length + (len + MBFL_MEMORY_DEVICE_ALLOC_SIZE)*sizeof(unsigned char); + if (newlen <= 0) { + /* overflow */ + return -1; + } unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char)); if (tmp == NULL) { return -1; @@ -254,6 +270,10 @@ mbfl_memory_device_strncat(mbfl_memory_device *device, const char *psrc, int len if ((device->pos + len) >= device->length) { /* reallocate buffer */ int newlen = device->length + len + MBFL_MEMORY_DEVICE_ALLOC_SIZE; + if (newlen <= 0) { + /* overflow */ + return -1; + } unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char)); if (tmp == NULL) { return -1; @@ -281,6 +301,10 @@ mbfl_memory_device_devcat(mbfl_memory_device *dest, mbfl_memory_device *src) if ((dest->pos + src->pos) >= dest->length) { /* reallocate buffer */ int newlen = dest->length + src->pos + MBFL_MEMORY_DEVICE_ALLOC_SIZE; + if (newlen <= 0) { + /* overflow */ + return -1; + } unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)dest->buffer, newlen*sizeof(unsigned char)); if (tmp == NULL) { return -1; @@ -336,6 +360,10 @@ mbfl_wchar_device_output(int c, void *data) unsigned int *tmp; newlen = device->length + device->allocsz; + if (newlen <= 0) { + /* overflow */ + return -1; + } tmp = (unsigned int *)mbfl_realloc((void *)device->buffer, newlen*sizeof(int)); if (tmp == NULL) { return -1; diff --git a/ext/standard/string.c b/ext/standard/string.c index 491e97a070..246f452913 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -20,8 +20,6 @@ /* $Id$ */ -/* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */ - #include <stdio.h> #include "php.h" #include "php_rand.h" |