com php-src: Fix bug #69248 - heap overflow vulnerability in regcomp.c: NEWS ext/ereg/regex/regcomp.c

Commit: fb04dcf6dbb48aecd8d2dc986806cb58c8ae5282 Author: Stanislav Malyshev <stas@php.net> Tue, 17 Mar 2015 17:04:57 -0700 Parents: 8b14d3052ffcffa17d6e2be652f20e18f8f562ad Branches: PHP-5.4 PHP-5.5 PHP-5.6 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=fb04dcf6dbb48aecd8d2dc986806cb58c8ae5282 Log: Fix bug #69248 - heap overflow vulnerability in regcomp.c Merged from https://github.com/garyhouston/regex/commit/70bc2965604b6b8aaf260049e64c708dddf85334 Bugs: https://bugs.php.net/69248 Changed paths: M NEWS M ext/ereg/regex/regcomp.c Diff: diff --git a/NEWS b/NEWS index 5d4925b..06857cc 100644 --- a/NEWS +++ b/NEWS @@ -8,6 +8,9 @@ PHP NEWS configuration options). (Anatol Belski) . Fixed bug #69207 (move_uploaded_file allows nulls in path). (Stas) +- Ereg: + . Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (Stas) + - SOAP: . Fixed bug #69085 (SoapClient's __call() type confusion through unserialize()). (Dmitry) diff --git a/ext/ereg/regex/regcomp.c b/ext/ereg/regex/regcomp.c index 156eee9..f4bfc1c 100644 --- a/ext/ereg/regex/regcomp.c +++ b/ext/ereg/regex/regcomp.c @@ -117,7 +117,15 @@ int cflags; (NC-1)*sizeof(cat_t)); if (g == NULL) return(REG_ESPACE); - p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */ + { + /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */ + size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */ + if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) { + free((char *) g); + return REG_INVARG; + } + p->ssize = new_ssize; + } p->strip = (sop *)malloc(p->ssize * sizeof(sop)); p->slen = 0; if (p->strip == NULL) {