com php-src: Fix bug #67251 - date_parse_from_format ou t-of-bounds read: ext/date/lib/parse_date.c ext/dat e/lib/parse_date.re
ext/date/tests/bug67251.p hpt

Commit: 3c328f09840c58698cedd6bbd30bdc8a24f5b41f Author: Stanislav Malyshev <stas@php.net> Sun, 11 May 2014 19:34:21 -0700 Parents: d780c2a673ef25166aaec994f14bfec4f57ab8dd Branches: PHP-5.3 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=3c328f09840c58698cedd6bbd30bdc8a24f5b41f Log: Fix bug #67251 - date_parse_from_format out-of-bounds read Conflicts: ext/date/lib/parse_date.c ext/date/lib/parse_date.re Bugs: https://bugs.php.net/67251 Changed paths: M ext/date/lib/parse_date.c M ext/date/lib/parse_date..re A ext/date/tests/bug67251.phpt Diff: diff --git a/ext/date/lib/parse_date.c b/ext/date/lib/parse_date.c index 8583f30..a3364ef 100644 --- a/ext/date/lib/parse_date.c +++ b/ext/date/lib/parse_date.c @@ -25121,7 +25121,11 @@ timelib_time *timelib_parse_from_format(char *format, char *string, int len, tim break; case '\\': /* escaped char */ - *fptr++; + if(!fptr[1]) { + add_pbf_error(s, "Escaped character expected", string, begin); + break; + } + fptr++; if (*ptr == *fptr) { ++ptr; } else { diff --git a/ext/date/lib/parse_date.re b/ext/date/lib/parse_date.re index b130fd0..1fbd670 100644 --- a/ext/date/lib/parse_date.re +++ b/ext/date/lib/parse_date.re @@ -2128,7 +2128,11 @@ timelib_time *timelib_parse_from_format(char *format, char *string, int len, tim break; case '\\': /* escaped char */ - *fptr++; + if(!fptr[1]) { + add_pbf_error(s, "Escaped character expected", string, begin); + break; + } + fptr++; if (*ptr == *fptr) { ++ptr; } else { diff --git a/ext/date/tests/bug67251.phpt b/ext/date/tests/bug67251.phpt new file mode 100644 index 0000000..68c56a1 --- /dev/null +++ b/ext/date/tests/bug67251.phpt @@ -0,0 +1,38 @@ +--TEST-- +Bug #67251 (date_parse_from_format out-of-bounds read) +--INI-- +date.timezone=Europe/Berlin +--FILE-- +<?php +var_dump(date_parse_from_format("\\","AAAABBBB")); +--EXPECT-- +array(12) { + ["year"]=> + bool(false) + ["month"]=> + bool(false) + ["day"]=> + bool(false) + ["hour"]=> + bool(false) + ["minute"]=> + bool(false) + ["second"]=> + bool(false) + ["fraction"]=> + bool(false) + ["warning_count"]=> + int(0) + ["warnings"]=> + array(0) { + } + ["error_count"]=> + int(2) + ["errors"]=> + array(1) { + [0]=> + string(13) "Trailing data" + } + ["is_localtime"]=> + bool(false) +}