cvs: php4(PHP_4_3) / TODO_SEGFAULTS
| From: | Ilia Alshanetsky | Date: | Thu, 10 Apr 2003 03:27:34 +0000 |
| Subject: | cvs: php4(PHP_4_3) / TODO_SEGFAULTS | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-20203@lists.php.net to get a copy of this message | ||
iliaa Wed Apr 9 23:27:34 2003 EDT
Modified files: (Branch: PHP_4_3)
/php4 TODO_SEGFAULTS
Log:
More integer overflows.
Index: php4/TODO_SEGFAULTS
diff -u php4/TODO_SEGFAULTS:1.1.2.29 php4/TODO_SEGFAULTS:1.1.2.30
--- php4/TODO_SEGFAULTS:1.1.2.29 Mon Apr 7 20:22:37 2003
+++ php4/TODO_SEGFAULTS Wed Apr 9 23:27:34 2003
@@ -31,6 +31,8 @@
imagesetstyle (5)
bundled gd (6)
exif extension (7)
+ php_base64_encode (8)
+ pack (9)
(1) heap corruption, mostly visible in malloc-related calls. Whether you see
this or not might depend on your libc/compiler. Hard to track down,
@@ -97,6 +99,9 @@
(7) few possible integer overflows, once safe_emalloc() or something similar
is implemented they can all be addressed.
+(8) integer overflow if the specified string is longer then ~1.1 billion bytes.
+
+(9) multiple integer overflows, ex. pack("d4294967297", 2);
Ammendment 1.