com php-src: add test: ext/fileinfo/tests/cve-2014-3538.phpt
| From: | Stanislav Malyshev | Date: | Mon, 04 Aug 2014 07:08:08 +0000 |
| Subject: | com php-src: add test: ext/fileinfo/tests/cve-2014-3538.phpt | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-79705@lists.php.net to get a copy of this message | ||
Commit: 61ec9b5b0f80bc6016548d48f433fe22e2dc24ec
Author: Stanislav Malyshev <stas@php.net> Mon, 4 Aug 2014 00:08:08 -0700
Parents: eeaec70758bfc0c0e2c0f8944c8dbeae02866206
Branches: PHP-5.4 PHP-5.5 PHP-5.6 master
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=61ec9b5b0f80bc6016548d48f433fe22e2dc24ec
Log:
add test
Changed paths:
A ext/fileinfo/tests/cve-2014-3538.phpt
Diff:
diff --git a/ext/fileinfo/tests/cve-2014-3538.phpt b/ext/fileinfo/tests/cve-2014-3538.phpt
new file mode 100644
index 0000000..d6bc9c6
--- /dev/null
+++ b/ext/fileinfo/tests/cve-2014-3538.phpt
@@ -0,0 +1,35 @@
+--TEST--
+Bug #66731: file: extensive backtraking
+--SKIPIF--
+<?php
+if (!class_exists('finfo'))
+ die('skip no fileinfo extension');
+--FILE--
+<?php
+$fd = __DIR__.'/cve-2014-3538.data';
+
+file_put_contents($fd,
+ 'try:' .
+ str_repeat("\n", 1000000));
+
+$fi = finfo_open(FILEINFO_NONE);
+$t = microtime(true);
+var_dump(finfo_file($fi, $fd));
+$t = microtime(true) - $t;
+finfo_close($fi);
+if ($t < 1) {
+ echo "Ok\n";
+} else {
+ printf("Failed, time=%.2f\n", $t);
+}
+
+?>
+Done
+--CLEAN--
+<?php
+@unlink(__DIR__..'/cve-2014-3538.data');
+?>
+--EXPECTF--
+string(%d) "%s"
+Ok
+Done
\ No newline at end of file