cvs: php-src(PHP_4_4) /ext/session session.c

iliaa Sun Dec 31 22:26:25 2006 UTC Modified files: (Branch: PHP_4_4) /php-src/ext/session session.c Log: MFH: Added boundary checks to php_binary deserializer http://cvs.php.net/viewvc.cgi/php-src/ext/session/session.c?r1=1.336.2.53.2.10&r2=1.336.2.53.2.11&diff_format=u Index: php-src/ext/session/session.c diff -u php-src/ext/session/session.c:1.336.2.53.2.10 php-src/ext/session/session.c:1.336.2.53.2.11 --- php-src/ext/session/session.c:1.336.2.53.2.10 Tue Dec 26 17:23:33 2006 +++ php-src/ext/session/session.c Sun Dec 31 22:26:25 2006 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: session.c,v 1.336.2.53.2.10 2006/12/26 17:23:33 iliaa Exp $ */ +/* $Id: session.c,v 1.336.2.53.2.11 2006/12/31 22:26:25 iliaa Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" @@ -424,6 +424,11 @@ for (p = val; p < endptr; ) { zval **tmp; namelen = *p & (~PS_BIN_UNDEF); + + if (namelen > PS_BIN_MAX || (p + namelen) >= endptr) { + return FAILURE; + } + has_value = *p & PS_BIN_UNDEF ? 0 : 1; name = estrndup(p + 1, namelen);