cvs: php-src / NEWS /ext/standard string.c

tony2001 Thu Jul 7 11:19:41 2005 EDT Modified files: /php-src NEWS /php-src/ext/standard string.c Log: fix #33605 (substr_compare() crashes with negative offset & length) http://cvs.php.net/diff.php/php-src/NEWS?r1=1.1985&r2=1.1986&ty=u Index: php-src/NEWS diff -u php-src/NEWS:1.1985 php-src/NEWS:1.1986 --- php-src/NEWS:1.1985 Thu Jul 7 11:16:56 2005 +++ php-src/NEWS Thu Jul 7 11:19:40 2005 @@ -10,6 +10,8 @@ - Fixed memory corruption in pg_copy_from() in case the as_null parameter was passed. (Derick) - Fixed crash inside stream_get_line() when length parameter equals 0. (Ilia) +- Fixed bug #33605 (substr_compare() crashes with negative offset and length). + (Tony) - Fixed bug #33578 (strtotime() doesn't understand "11 Oct" format). (Derick) - Fixed bug #33562 (date("") crashes). (Derick) - Fixed bug #33536 (strtotime() defaults to now even on non time string). http://cvs.php.net/diff.php/php-src/ext/standard/string.c?r1=1.441&r2=1.442&ty=u Index: php-src/ext/standard/string.c diff -u php-src/ext/standard/string.c:1.441 php-src/ext/standard/string.c:1.442 --- php-src/ext/standard/string.c:1.441 Sun Jun 19 12:31:51 2005 +++ php-src/ext/standard/string.c Thu Jul 7 11:19:40 2005 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: string.c,v 1.441 2005/06/19 16:31:51 iliaa Exp $ */ +/* $Id: string.c,v 1.442 2005/07/07 15:19:40 tony2001 Exp $ */ /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */ @@ -4446,6 +4446,10 @@ if (ac > 2) { convert_to_long_ex(offset); + if (Z_LVAL_PP(offset) < 0) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset should be greater then or equal to 0."); + RETURN_FALSE; + } p += Z_LVAL_PP(offset); if (p > endp) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset value %ld exceeds string length.", Z_LVAL_PP(offset)); @@ -4453,6 +4457,10 @@ } if (ac == 4) { convert_to_long_ex(length); + if (Z_LVAL_PP(length) <= 0) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length should be greater than 0."); + RETURN_FALSE; + } if ((p + Z_LVAL_PP(length)) > endp) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length value %ld exceeds string length.", Z_LVAL_PP(length)); RETURN_FALSE;