com php-src: Merge branch 'PHP-5.5' into PHP-5.6: NEWS ext/zip/lib/zip_dirent.c

Commit: 225cb973e5e8371b54d174c32f8685fcd2cf4098 Author: Stanislav Malyshev <stas@php.net> Tue, 17 Mar 2015 22:02:57 -0700 Parents: 749f82af02f4ed0570d5e3a4cf6a1a8f5e9b1514 210cfafc2b3a1f72f520679b1b302abb8b1a14d0 Branches: PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=225cb973e5e8371b54d174c32f8685fcd2cf4098 Log: Merge branch 'PHP-5.5' into PHP-5.6 * PHP-5.5: update NEWS Fix bug #69253 - ZIP Integer Overflow leads to writing past heap boundary Conflicts: ext/zip/lib/zip_dirent.c Bugs: https://bugs.php.net/69253 Changed paths: MM NEWS MM ext/zip/lib/zip_dirent.c Diff: diff --cc NEWS index c0e2e04,c6c6a91..7a5d705 --- a/NEWS +++ b/NEWS @@@ -44,7 -42,11 +44,11 @@@ PH . Fixed #69227 (Use after free in zval_scan caused by spl_object_storage_get_gc). (adam dot scarr at 99designs dot com) + - ZIP: + . Fixed bug #69253 (ZIP Integer Overflow leads to writing past heap + boundary). (Stas) + -19 Mar 2015, PHP 5.5.23 +19 Mar 2015, PHP 5.6.7 - Core: . Fixed bug #69174 (leaks when unused inner class use traits precedence). diff --cc ext/zip/lib/zip_dirent.c index 38e7ece,0090801..5b8da73 --- a/ext/zip/lib/zip_dirent.c +++ b/ext/zip/lib/zip_dirent.c @@@ -108,9 -101,8 +108,9 @@@ _zip_cdir_new(zip_uint64_t nentry, stru return NULL; } - if ( nentry > ((size_t)-1)/sizeof(*(cd->entry)) || (cd->entry=(struct zip_dirent *)malloc(sizeof(*(cd->entry))*(size_t)nentry)) - == NULL) { + if (nentry == 0) + cd->entry = NULL; - else if ((cd->entry=(struct zip_entry *)malloc(sizeof(*(cd->entry))*(size_t)nentry)) == NULL) { ++ else if (nentry > ((size_t)-1)/sizeof(*(cd->entry)) || (cd->entry=(struct zip_entry *)malloc(sizeof(*(cd->entry))*(size_t)nentry)) == NULL) { _zip_error_set(error, ZIP_ER_MEMORY, 0); free(cd); return NULL;