cvs: php-src /ext/standard string.c /ext/standard/tests/strings chunk_split.phpt

iliaa Sun Jun 3 18:53:51 2007 UTC Modified files: /php-src/ext/standard string.c /php-src/ext/standard/tests/strings chunk_split.phpt Log: MFB: Corrected fix for CVE-2007-2872 http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.638&r2=1.639&diff_format=u Index: php-src/ext/standard/string.c diff -u php-src/ext/standard/string.c:1.638 php-src/ext/standard/string.c:1.639 --- php-src/ext/standard/string.c:1.638 Wed May 30 00:38:00 2007 +++ php-src/ext/standard/string.c Sun Jun 3 18:53:51 2007 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: string.c,v 1.638 2007/05/30 00:38:00 iliaa Exp $ */ +/* $Id: string.c,v 1.639 2007/06/03 18:53:51 iliaa Exp $ */ /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */ @@ -3083,7 +3083,7 @@ int chunks; /* complete chunks! */ int restlen; int charsize = sizeof(char); - int out_len; + float out_len; if (str_type == IS_UNICODE) { charsize = sizeof(UChar); @@ -3092,13 +3092,15 @@ chunks = srclen / chunklen; restlen = srclen - chunks * chunklen; /* srclen % chunklen */ - out_len = (srclen + (chunks + 1) * endlen + 1); + out_len = chunks + 1; + out_len *= endlen; + out_len += srclen + 1; if ((out_len > INT_MAX || out_len <= 0) || ((out_len * charsize) > INT_MAX || (out_len * charsize) <= 0)) { return NULL; } - dest = safe_emalloc(out_len, charsize, 0); + dest = safe_emalloc((int)out_len, charsize, 0); for (p = src, q = dest; p < (src + charsize * (srclen - chunklen + 1)); ) { memcpy(q, p, chunklen * charsize); http://cvs.php.net/viewvc.cgi/php-src/ext/standard/tests/strings/chunk_split.phpt?r1=1.4&r2=1.5&diff_format=u Index: php-src/ext/standard/tests/strings/chunk_split.phpt diff -u php-src/ext/standard/tests/strings/chunk_split.phpt:1.4 php-src/ext/standard/tests/strings/chunk_split.phpt:1.5 --- php-src/ext/standard/tests/strings/chunk_split.phpt:1.4 Wed May 30 00:38:00 2007 +++ php-src/ext/standard/tests/strings/chunk_split.phpt Sun Jun 3 18:53:51 2007 @@ -12,6 +12,12 @@ $c=str_repeat("B", 65535); var_dump(chunk_split($a,$b,$c)); +$a=str_repeat("B", 65536); +$b=1; +$c=str_repeat("B", 65536); +var_dump(chunk_split($a,$b,$c)); + + ?> --EXPECT-- a-b-c- @@ -25,3 +31,4 @@ test|end bool(false) +bool(false)