Re: com php-src: fix integer overflow in {stream,file}_{get,put}_contents(): ext/standard/file.c ext/standard/streamsfuncs.c

Yes, I'll do! Sorry, Mike On 30 Jul 2014 11:02, "Ferenc Kovacs" <tyra3l@gmail.com> wrote: > > > > On Wed, Jul 2, 2014 at 9:53 AM, Michael Wallner <mike@php.net> wrote: > >> Commit: 34e686c5562bfd289d330f5dae2dafec4e58a20c >> Author: Michael Wallner <mike@php.net> Wed, 2 Jul 2014 >> 09:53:03 +0200 >> Parents: 899fe3d8af42dc09c3f0ed2915e516c068166a43 >> Branches: PHP-5.4 PHP-5.5 PHP-5.6 master >> >> Link: >> >> http://git.php.net/?p=php-src.git;a=commitdiff;h=34e686c5562bfd289d330f5dae2dafec4e58a20c >> >> Log: >> fix integer overflow in {stream,file}_{get,put}_contents() >> >> Changed paths: >> M ext/standard/file.c >> M ext/standard/streamsfuncs.c >> >> >> Diff: >> diff --git a/ext/standard/file.c b/ext/standard/file.c >> index 6bcaef7..708c3e2 100644 >> --- a/ext/standard/file.c >> +++ b/ext/standard/file.c >> @@ -518,7 +518,7 @@ PHP_FUNCTION(file_get_contents) >> char *contents; >> zend_bool use_include_path = 0; >> php_stream *stream; >> - int len; >> + long len; >> long offset = -1; >> long maxlen = PHP_STREAM_COPY_ALL; >> zval *zcontext = NULL; >> @@ -550,6 +550,10 @@ PHP_FUNCTION(file_get_contents) >> } >> >> if ((len = php_stream_copy_to_mem(stream, &contents, maxlen, 0)) >> > 0) { >> + if (len > INT_MAX) { >> + php_error_docref(NULL TSRMLS_CC, E_WARNING, >> "content truncated from %ld to %d bytes", len, INT_MAX); >> + len = INT_MAX; >> + } >> RETVAL_STRINGL(contents, len, 0); >> } else if (len == 0) { >> RETVAL_EMPTY_STRING(); >> @@ -569,7 +573,7 @@ PHP_FUNCTION(file_put_contents) >> char *filename; >> int filename_len; >> zval *data; >> - int numbytes = 0; >> + long numbytes = 0; >> long flags = 0; >> zval *zcontext = NULL; >> php_stream_context *context = NULL; >> @@ -621,6 +625,10 @@ PHP_FUNCTION(file_put_contents) >> if (php_stream_copy_to_stream_ex(srcstream, >> stream, PHP_STREAM_COPY_ALL, &len) != SUCCESS) { >> numbytes = -1; >> } else { >> + if (len > LONG_MAX) { >> + php_error_docref(NULL TSRMLS_CC, >> E_WARNING, "content truncated from %lu to %ld bytes", (unsigned long) len, >> LONG_MAX); >> + len = LONG_MAX; >> + } >> numbytes = len; >> } >> break; >> @@ -636,7 +644,7 @@ PHP_FUNCTION(file_put_contents) >> if (Z_STRLEN_P(data)) { >> numbytes = php_stream_write(stream, >> Z_STRVAL_P(data), Z_STRLEN_P(data)); >> if (numbytes != Z_STRLEN_P(data)) { >> - php_error_docref(NULL TSRMLS_CC, >> E_WARNING, "Only %d of %d bytes written, possibly out of free disk space", >> numbytes, Z_STRLEN_P(data)); >> + php_error_docref(NULL TSRMLS_CC, >> E_WARNING, "Only %ld of %d bytes written, possibly out of free disk space", >> numbytes, Z_STRLEN_P(data)); >> numbytes = -1; >> } >> } >> @@ -679,7 +687,7 @@ PHP_FUNCTION(file_put_contents) >> if (zend_std_cast_object_tostring(data, >> &out, IS_STRING TSRMLS_CC) == SUCCESS) { >> numbytes = >> php_stream_write(stream, Z_STRVAL(out), Z_STRLEN(out)); >> if (numbytes != Z_STRLEN(out)) { >> - php_error_docref(NULL >> TSRMLS_CC, E_WARNING, "Only %d of %d bytes written, possibly out of free >> disk space", numbytes, Z_STRLEN(out)); >> + php_error_docref(NULL >> TSRMLS_CC, E_WARNING, "Only %ld of %d bytes written, possibly out of free >> disk space", numbytes, Z_STRLEN(out)); >> numbytes = -1; >> } >> zval_dtor(&out); >> diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c >> index bdb05ec..b1b3180 100644 >> --- a/ext/standard/streamsfuncs.c >> +++ b/ext/standard/streamsfuncs.c >> @@ -407,7 +407,7 @@ PHP_FUNCTION(stream_get_contents) >> zval *zsrc; >> long maxlen = PHP_STREAM_COPY_ALL, >> desiredpos = -1L; >> - int len; >> + long len; >> char *contents = NULL; >> >> if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|ll", >> &zsrc, &maxlen, &desiredpos) == FAILURE) { >> @@ -439,6 +439,10 @@ PHP_FUNCTION(stream_get_contents) >> len = php_stream_copy_to_mem(stream, &contents, maxlen, 0); >> >> if (contents) { >> + if (len > INT_MAX) { >> + php_error_docref(NULL TSRMLS_CC, E_WARNING, >> "content truncated from %ld to %d bytes", len, INT_MAX); >> + len = INT_MAX; >> + } >> RETVAL_STRINGL(contents, len, 0); >> } else { >> RETVAL_EMPTY_STRING(); >> >> >> -- >> PHP CVS Mailing List (http://www.php.net/) >> To unsubscribe, visit: http://www.php.net/unsub.php >> >> > Hi Mike, > > could you please next time log a bug to bugs.php.net (as discussed at > > http://grokbase.com/t/php/php-internals/14654hzrgc/should-every-bugfix-have-a-bugreport > ) so that we reference that in the NEWS file and eventually in the > Changelog? > thanks! > > -- > Ferenc Kovács > @Tyr43l - http://tyrael.hu >