From 6c48a01f40ff390c811f7080a19284c6e093980c Mon Sep 17 00:00:00 2001 From: Scott MacVicar Date: Tue, 22 Jul 2008 01:10:58 +0000 Subject: MFH: Fix integer oveflow in strrpos() --- ext/standard/string.c | 2 +- ext/standard/tests/strings/strrpos_offset.phpt | 41 ++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 ext/standard/tests/strings/strrpos_offset.phpt diff --git a/ext/standard/string.c b/ext/standard/string.c index 9930110624..3d6dabfe7a 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -1842,7 +1842,7 @@ PHP_FUNCTION(strrpos) p = haystack + offset; e = haystack + haystack_len - needle_len; } else { - if (-offset > haystack_len) { + if (-offset > haystack_len || offset < -INT_MAX) { php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Offset is greater than the length of haystack string"); RETURN_FALSE; } diff --git a/ext/standard/tests/strings/strrpos_offset.phpt b/ext/standard/tests/strings/strrpos_offset.phpt new file mode 100644 index 0000000000..6d641ab1e1 --- /dev/null +++ b/ext/standard/tests/strings/strrpos_offset.phpt @@ -0,0 +1,41 @@ +--TEST-- +strrpos() offset integer overflow +--FILE-- + +--EXPECTF-- +Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) + +Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) + +Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) + +Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) + +Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) + +Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) + +Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) + +Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) +Done -- cgit v1.2.1