com php-src: Fix bug #67249: printf out-of-bounds read: ext/standard/formatted_print.c ext/standard/tests/strings /bug67249.phpt

Commit: d780c2a673ef25166aaec994f14bfec4f57ab8dd Author: Stanislav Malyshev <stas@php.net> Sun, 11 May 2014 18:44:14 -0700 Parents: d400b74296989afadddc960db5ad103bf61e51d0 Branches: PHP-5.3 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=d780c2a673ef25166aaec994f14bfec4f57ab8dd Log: Fix bug #67249: printf out-of-bounds read Bugs: https://bugs.php.net/67249 Changed paths: M ext/standard/formatted_print.c A ext/standard/tests/strings/bug67249.phpt Diff: diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c index d69b79b..383ca1a 100644 --- a/ext/standard/formatted_print.c +++ b/ext/standard/formatted_print.c @@ -379,6 +379,7 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC int alignment, currarg, adjusting, argnum, width, precision; char *format, *result, padding; int always_sign; + int format_len; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "+", &args, &argc) == FAILURE) { return NULL; @@ -417,11 +418,12 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC convert_to_string_ex(args[format_offset]); format = Z_STRVAL_PP(args[format_offset]); + format_len = Z_STRLEN_PP(args[format_offset]); result = emalloc(size); currarg = 1; - while (inpos<Z_STRLEN_PP(args[format_offset])) { + while (inpos<format_len) { int expprec = 0, multiuse = 0; zval *tmp; @@ -476,7 +478,7 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC /* space padding, the default */ } else if (format[inpos] == '+') { always_sign = 1; - } else if (format[inpos] == '\'') { + } else if (format[inpos] == '\'' && inpos+1<format_len) { padding = format[++inpos]; } else { PRINTF_DEBUG(("sprintf: end of modifiers\n")); diff --git a/ext/standard/tests/strings/bug67249.phpt b/ext/standard/tests/strings/bug67249.phpt new file mode 100644 index 0000000..6ea7528 --- /dev/null +++ b/ext/standard/tests/strings/bug67249.phpt @@ -0,0 +1,8 @@ +--TEST-- +Bug #67249 (printf out-of-bounds read) +--FILE-- +<?php +var_dump(sprintf("%'", "foo")); +?> +--EXPECT-- +string(0) ""