Bug #68675 [Opn->Csd]: Off-by-one out-of-boudns write
| From: | bugreports at internot dot info | Date: | Tue, 30 Dec 2014 03:52:26 +0000 |
| Subject: | Bug #68675 [Opn->Csd]: Off-by-one out-of-boudns write | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-189323@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=68675&edit=1
ID: 68675
User updated by: bugreports at internot dot info
Reported by: bugreports at internot dot info
Summary: Off-by-one out-of-boudns write
-Status: Open
+Status: Closed
Type: Bug
Package: mbstring related
Operating System: Linux Ubuntu 14.04
PHP Version: master-Git-2014-12-29 (Git)
Block user comment: N
Private report: N
New Comment:
This is invalid.
Previous Comments:
------------------------------------------------------------------------
[2014-12-29 02:01:15] bugreports at internot dot info
Description:
------------
Hi,
In /ext/mbstring/oniguruma/regcomp.c:
4240 for (j = 0; j < len && p < end; j++)
4241 to->s[i++] = *p++;
to->s[] may overflow, because i++ may get up to 24, and to->s is 24, causing a 1 byte OoB
write.
Thanks,
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=68675&edit=1