cvs: php4 /ext/mbstring mbstring.c

moriyoshi Thu Nov 14 16:33:36 2002 EDT Modified files: /php4/ext/mbstring mbstring.c Log: Fixed possible buffer over run in php_mb_safe_strrchr_ex() Index: php4/ext/mbstring/mbstring.c diff -u php4/ext/mbstring/mbstring.c:1.144 php4/ext/mbstring/mbstring.c:1.145 --- php4/ext/mbstring/mbstring.c:1.144 Thu Nov 14 13:54:42 2002 +++ php4/ext/mbstring/mbstring.c Thu Nov 14 16:33:36 2002 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: mbstring.c,v 1.144 2002/11/14 18:54:42 moriyoshi Exp $ */ +/* $Id: mbstring.c,v 1.145 2002/11/14 21:33:36 moriyoshi Exp $ */ /* * PHP4 Multibyte String module "mbstring" (currently only for Japanese) @@ -3459,17 +3459,26 @@ char *last=NULL; if (nbytes == (size_t)-1) { + size_t nb = 0; + while (*p != '\0') { - if ((unsigned int)*p == c) { - last = (char *)p; + if (nb == 0) { + if ((unsigned char)*p == (unsigned char)c) { + last = (char *)p; + } + nb = php_mb_mbchar_bytes_ex(p, enc); + if (nb == 0) { + return NULL; /* something is going wrong! */ + } } - p += php_mb_mbchar_bytes_ex(p, enc); + --nb; + ++p; } } else { register size_t bcnt = nbytes; register size_t nbytes_char; while (bcnt > 0) { - if ((unsigned int)*p == c) { + if ((unsigned char)*p == (unsigned char)c) { last = (char *)p; } nbytes_char = php_mb_mbchar_bytes_ex(p, enc);