diff options
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | ext/mbstring/libmbfl/mbfl/mbfilter.c | 2 | ||||
| -rw-r--r-- | ext/mbstring/libmbfl/mbfl/mbfilter.h | 7 | ||||
| -rw-r--r-- | ext/mbstring/tests/bug76532.phpt | 12 |
4 files changed, 24 insertions, 1 deletions
@@ -15,6 +15,10 @@ PHP NEWS . Fixed bug #73342 (Vulnerability in php-fpm by changing stdin to non-blocking). (Nikita) +- mbstring: + . Fixed bug #76532 (Integer overflow and excessive memory usage + in mb_strimwidth). (MarcusSchwarz) + - phpdbg: . Fix arginfo wrt. optional/required parameters. (cmb) diff --git a/ext/mbstring/libmbfl/mbfl/mbfilter.c b/ext/mbstring/libmbfl/mbfl/mbfilter.c index 4986472b9b..35ca9d3b9c 100644 --- a/ext/mbstring/libmbfl/mbfl/mbfilter.c +++ b/ext/mbstring/libmbfl/mbfl/mbfilter.c @@ -1875,7 +1875,7 @@ mbfl_strimwidth( mbfl_string_init(result); result->no_language = string->no_language; result->no_encoding = string->no_encoding; - mbfl_memory_device_init(&pc.device, width, 0); + mbfl_memory_device_init(&pc.device, MIN(string->len, width), 0); /* output code filter */ pc.decoder = mbfl_convert_filter_new( diff --git a/ext/mbstring/libmbfl/mbfl/mbfilter.h b/ext/mbstring/libmbfl/mbfl/mbfilter.h index 565ed3252d..215e07d1d6 100644 --- a/ext/mbstring/libmbfl/mbfl/mbfilter.h +++ b/ext/mbstring/libmbfl/mbfl/mbfilter.h @@ -114,6 +114,13 @@ #define MBFL_OUTPUTFILTER_ILLEGAL_MODE_ENTITY 3 /* + * convenience macros + */ +#ifndef MIN +#define MIN(a,b) ((a)<(b)?(a):(b)) +#endif + +/* * buffering converter */ typedef struct _mbfl_buffer_converter mbfl_buffer_converter; diff --git a/ext/mbstring/tests/bug76532.phpt b/ext/mbstring/tests/bug76532.phpt new file mode 100644 index 0000000000..e61e403dbf --- /dev/null +++ b/ext/mbstring/tests/bug76532.phpt @@ -0,0 +1,12 @@ +--TEST-- +Bug #76532 (Integer overflow and excessive memory usage in mb_strimwidth) +--SKIPIF-- +<?php require 'skipif.inc'; ?> +--FILE-- +<?php +$string_to_trim = '得很幸福。有一天，一个长得很丑的老人带着一只木马来到王'; +$width = 2147483647; +var_dump(mb_strimwidth($string_to_trim, 0, $width)); +?> +--EXPECT-- +string(81) "得很幸福。有一天，一个长得很丑的老人带着一只木马来到王"
\ No newline at end of file |