com php-src: add some range checks to ext/dom: ext/dom/document.c

Commit: 201afce875b90d3675ff2eedc8b8d74f1e62b2d1 Author: Anatol Belski <ab@php.net> Tue, 25 Aug 2015 17:54:27 +0200 Parents: a3dceb485a610808b30f17aae1d2d2ae6f5ccbb6 Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=201afce875b90d3675ff2eedc8b8d74f1e62b2d1 Log: add some range checks to ext/dom Changed paths: M ext/dom/document.c Diff: diff --git a/ext/dom/document.c b/ext/dom/document.c index 64d3ca4..6db61a3 100644 --- a/ext/dom/document.c +++ b/ext/dom/document.c @@ -1493,6 +1493,14 @@ static void dom_parse_document(INTERNAL_FUNCTION_PARAMETERS, int mode) { php_error_docref(NULL, E_WARNING, "Empty string supplied as input"); RETURN_FALSE; } + if (ZEND_SIZE_T_INT_OVFL(source_len)) { + php_error_docref(NULL, E_WARNING, "Input string is too long"); + RETURN_FALSE; + } + if (ZEND_LONG_EXCEEDS_INT(options)) { + php_error_docref(NULL, E_WARNING, "Invalid options"); + RETURN_FALSE; + } newdoc = dom_document_parser(id, mode, source, source_len, options); @@ -2001,6 +2009,11 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */ RETURN_FALSE; } + if (ZEND_LONG_EXCEEDS_INT(options)) { + php_error_docref(NULL, E_WARNING, "Invalid options"); + RETURN_FALSE; + } + if (mode == DOM_LOAD_FILE) { if (CHECK_NULL_PATH(source, source_len)) { php_error_docref(NULL, E_WARNING, "Invalid file source"); @@ -2009,7 +2022,11 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */ ctxt = htmlCreateFileParserCtxt(source, NULL); } else { source_len = xmlStrlen((xmlChar *) source); - ctxt = htmlCreateMemoryParserCtxt(source, source_len); + if (ZEND_SIZE_T_INT_OVFL(source_len)) { + php_error_docref(NULL, E_WARNING, "Input string is too long"); + RETURN_FALSE; + } + ctxt = htmlCreateMemoryParserCtxt(source, (int)source_len); } if (!ctxt) { @@ -2017,7 +2034,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */ } if (options) { - htmlCtxtUseOptions(ctxt, options); + htmlCtxtUseOptions(ctxt, (int)options); } ctxt->vctxt..error = php_libxml_ctx_error;