Bug #53273 [Asn->Csd]: mb_strcut() returns garbage with the excessive length parameter

Edit report at http://bugs.php.net/bug.php?id=53273&edit=1 ID: 53273 Updated by: pajoye@php.net Reported by: moriyoshi@php.net Summary: mb_strcut() returns garbage with the excessive length parameter -Status: Assigned +Status: Closed Type: Bug Package: mbstring related Operating System: Irrelevant PHP Version: 5.3 and above. Assigned To: moriyoshi Block user comment: N New Comment: CVE-2010-4156 assigned to this issue. Previous Comments: ------------------------------------------------------------------------ [2010-11-09 09:47:49] aharvey@php.net Is there anything else that needs to be done besides the earlier commit? ------------------------------------------------------------------------ [2010-11-09 04:23:06] moriyoshi@php.net Automatic comment from SVN on behalf of moriyoshi Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=305214 Log: - Fix bug #53273 (mb_strcut() returns garbage with the excessive length parameter). ------------------------------------------------------------------------ [2010-11-09 04:11:56] moriyoshi@php.net Description: ------------ mb_strcut() returns garbage when the following conditions are met: 1. The value specified to length parameter exceeds the length of the subject string. 2. mbstring.internal_encoding is set to some single-byte encoding. The garbage may consist of uncleared part of the heap that has previously been used for some purpose, which could lead to unexpected information exposure. This bug was originally reported by Mateusz Kocielski. Test script: --------------- <?php $b = "bbbbbbbbbbb"; str_repeat("THIS IS A SECRET MESSAGE, ISN'T IT?", 1); $var3 = mb_strcut($b, 0, 1000); echo $var3; ?> Expected result: ---------------- bbbbbbbbbbb Actual result: -------------- bbbbbbbbbbb??????D$Ј=m???=m?(?=m?`?=m??5<m??=m?THIS IS A SECRET MESSAGE, ISN'T IT??g?1@?=m?(?=m???=m?p?=m?var3 ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/bug.php?id=53273&edit=1