com php-src: fix length overflow of HTTP_RAW_POST_DATA: main/php_content_types.c
| From: | Michael Wallner | Date: | Thu, 03 Jul 2014 18:40:40 +0000 |
| Subject: | com php-src: fix length overflow of HTTP_RAW_POST_DATA: main/php_content_types.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-79224@lists.php.net to get a copy of this message | ||
Commit: 04c6a5b3773548388dec178058f270f30fc0c4de
Author: Michael Wallner <mike@php.net> Wed, 2 Jul 2014 10:09:05 +0200
Parents: 989cdabe25ba7201a12a5c3b6495cbc26ca0b172
Branches: PHP-5.6 master
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=04c6a5b3773548388dec178058f270f30fc0c4de
Log:
fix length overflow of HTTP_RAW_POST_DATA
Changed paths:
M main/php_content_types.c
Diff:
diff --git a/main/php_content_types.c b/main/php_content_types.c
index bc42c80..ca47e15 100644
--- a/main/php_content_types.c
+++ b/main/php_content_types.c
@@ -64,6 +64,12 @@ SAPI_API SAPI_POST_READER_FUNC(php_default_post_reader)
length = php_stream_copy_to_mem(SG(request_info).request_body, &data, PHP_STREAM_COPY_ALL,
0);
php_stream_rewind(SG(request_info).request_body);
+ if (length > INT_MAX) {
+ sapi_module.sapi_error(E_WARNING,
+ "HTTP_RAW_POST_DATA truncated from %lu to %d bytes",
+ (unsigned long) length, INT_MAX);
+ length = INT_MAX;
+ }
SET_VAR_STRINGL("HTTP_RAW_POST_DATA", data, length);
sapi_module.sapi_error(E_DEPRECATED,