[php-src] Issue #15257: OVERFLOW_AFTER_CHECK in sljitNativeX86_common.c

From: Date: Tue, 06 Aug 2024 15:10:22 +0000
Subject: [php-src] Issue #15257: OVERFLOW_AFTER_CHECK in sljitNativeX86_common.c
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-247445@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/15257 Author: ellena13 ### Description The static analyzer has detected OVERFLOW\_AFTER\_CHECK: the checker OVERFLOW\_AFTER\_CHECK finds situations where first, a variable is compared to some value, indicating what the possible values of the variable are, and then it’s used to access a buffer in such a way that one of the possible values indicated by the check lies out of bounds. _dst\_r_ (at sljitNativeX86_common.c:1790) is used as an index _dst_ for accessing an array's element in function _emit\_mov_ (at sljitNativeX86_common.c:919). https://github.com/php/php-src/blob/ca84662c8798ce96dc2dffc7562b2c0d96c1a6f3/ext/pcre/pcre2lib/sljit/sljitNativeX86_common.c#L1788-L1793 https://github.com/php/php-src/blob/ca84662c8798ce96dc2dffc7562b2c0d96c1a6f3/ext/pcre/pcre2lib/sljit/sljitNativeX86_common.c#L911-L919C _dst\_r_ can have value _17 and other <63_, which is out of range https://github.com/php/php-src/blob/ca84662c8798ce96dc2dffc7562b2c0d96c1a6f3/ext/pcre/pcre2lib/sljit/sljitNativeX86_common.c#L1773 Here we found _TMP\_REG1_ and _reg\_map[17]_ https://github.com/php/php-src/blob/6713d516319074bc2481b8e7db82b10841c230f7/ext/pcre/pcre2lib/sljit/sljitNativeX86_common.c#L92-L102 Here we found _FAST\_IS\_REG_ https://github.com/php/php-src/blob/6713d516319074bc2481b8e7db82b10841c230f7/ext/pcre/pcre2lib/sljit/sljitLir.c#L124-L130 Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE. Author E. Bykhanova (e.bykhanova@fobos-nt.ru). ### PHP Version PHP 8.2 ### Operating System _No response_

« previous php.bugs (#247445) next »