Re: cvs: php4(PHP_4_3) / TODO_SEGFAULTS
| From: | Moriyoshi Koizumi | Date: | Wed, 04 Jun 2003 17:32:50 +0000 |
| Subject: | Re: cvs: php4(PHP_4_3) / TODO_SEGFAULTS | ||
| References: | 1 | Groups: | php.cvs |
| Request: | Send a blank email to php-cvs+get-21529@lists.php.net to get a copy of this message | ||
"Ilia A." <ilia@prohost.org> wrote:
> On June 4, 2003 01:12 pm, Moriyoshi Koizumi wrote:
>
> If (srclen + (chunks + 1) * endlen + 1) overflows and results in a <0 number,
> the result of the multiplication inside safe_emalloc would still be negative
> and we'll trigger the integer overflow check.
I suppose (chunks + 1) * endlen could result in a negative number greater
than the negated srclen (-srclen)..
Moriyoshi