Bug #67247 [Opn->Csd]: spl_fixedarray_resize integer overflow
| From: | stas@php.net | Date: | Mon, 12 May 2014 01:58:04 +0000 |
| Subject: | Bug #67247 [Opn->Csd]: spl_fixedarray_resize integer overflow | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-185769@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=67247&edit=1
ID: 67247
Updated by: stas@php.net
Reported by: stas@php.net
Summary: spl_fixedarray_resize integer overflow
-Status: Open
+Status: Closed
Type: Bug
Package: *General Issues
Operating System: *
PHP Version: 5.4.28
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of stas
Revision: http://git.php.net/?p=php-src.git;a=commit;h=2b475eebbea85779989e98e87753d6b023a1d131
Log: Fix bug #67247 spl_fixedarray_resize integer overflow
Previous Comments:
------------------------------------------------------------------------
[2014-05-12 00:46:15] stas@php.net
Description:
------------
SplFixedArray does not check given parameters for integer overflows when resizing.
Test script:
---------------
$ar = new SplFixedArray(1);
echo "size: ".$ar->getSize()."\n";
$ar->setSize(0x2000000000000001); // or 0x40000001 for 32 bit
echo "size: ".$ar->getSize()."\n";
Expected result:
----------------
Integer overflow error
Actual result:
--------------
Can crash or produce valgrind error
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=67247&edit=1