com php-src: Fix bug #72138 - Integer Overflow in Length of String-typed ZVAL: NEWS ext/standard/string.c

Commit: 4c968c6ddd2d3eb46838db153264edf5c7b3fefa Author: Stanislav Malyshev <stas@php.net> Tue, 14 Jun 2016 01:03:03 -0700 Parents: 93e8f59aabb4d91f4ba952afc0768d9deca327b4 Branches: PHP-5.6 PHP-7.0 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=4c968c6ddd2d3eb46838db153264edf5c7b3fefa Log: Fix bug #72138 - Integer Overflow in Length of String-typed ZVAL Bugs: https://bugs.php..net/72138 Changed paths: M NEWS M ext/standard/string.c Diff: diff --git a/NEWS b/NEWS index 37907b3..3b0153b 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,9 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2016, PHP 5.6.24 +- Core: + . Fix bug #72138 (Integer Overflow in Length of String-typed ZVAL). (Stas) + - OpenSSL: . Fixed bug #71915 (openssl_random_pseudo_bytes is not fork-safe). (Jakub Zelenka) diff --git a/ext/standard/string.c b/ext/standard/string.c index d5f83e7..fa70945 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -3624,6 +3624,9 @@ PHPAPI int php_char_to_str_ex(char *str, uint len, char from, char *to, int to_l } Z_STRLEN_P(result) = len + (char_count * (to_len - 1)); + if (Z_STRLEN_P(result) < 0) { + zend_error(E_ERROR, "String size overflow"); + } Z_STRVAL_P(result) = target = safe_emalloc(char_count, to_len, len + 1); Z_TYPE_P(result) = IS_STRING;