Re: cvs: php4(PHP_4_3) / TODO_SEGFAULTS
| From: | Ilia A. | Date: | Wed, 04 Jun 2003 17:29:10 +0000 |
| Subject: | Re: cvs: php4(PHP_4_3) / TODO_SEGFAULTS | ||
| References: | 1 2 | Groups: | php.cvs |
| Request: | Send a blank email to php-cvs+get-21528@lists.php.net to get a copy of this message | ||
On June 4, 2003 01:12 pm, Moriyoshi Koizumi wrote:
If (srclen + (chunks + 1) * endlen + 1) overflows and results in a <0 number,
the result of the multiplication inside safe_emalloc would still be negative
and we'll trigger the integer overflow check.
Ilia
> "Ilia Alshanetsky" <iliaa@php.net> wrote:
> > - chunk_split (2)
>
> I might be missing something, but is chunk_split() really binary safe?
>
> dest = safe_emalloc(sizeof(char), (srclen + (chunks + 1) * endlen + 1), 0);
>
> What if integer overflow occurs during the calculation of (chunks + 1) *
> endlen?
>
> Moriyoshi