com php-src: Fix bug #72551 and bug #72552 - check before converting size_t->int: ext/mcrypt/mcrypt.c

Commit: 3810e7b362e7bdef00ad33ae683a49aa7ab19e0d Author: Stanislav Malyshev <stas@php.net> Tue, 12 Jul 2016 23:13:52 -0700 Parents: 2ca8d85dd4ac6d5f8c046f339f9636e3099b0f08 Branches: PHP-7.0 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=3810e7b362e7bdef00ad33ae683a49aa7ab19e0d Log: Fix bug #72551 and bug #72552 - check before converting size_t->int Bugs: https://bugs.php.net/72551 https://bugs.php.net/72552 Changed paths: M ext/mcrypt/mcrypt.c Diff: diff --git a/ext/mcrypt/mcrypt.c b/ext/mcrypt/mcrypt.c index fb5c638..73acaa2 100644 --- a/ext/mcrypt/mcrypt.c +++ b/ext/mcrypt/mcrypt.c @@ -645,6 +645,10 @@ PHP_FUNCTION(mcrypt_generic) memset(ZSTR_VAL(data_str), 0, data_size); memcpy(ZSTR_VAL(data_str), data, data_len); } else { /* It's not a block algorithm */ + if (data_len > INT_MAX) { + php_error_docref(NULL, E_WARNING, "Data size too large, %d maximum", INT_MAX); + RETURN_FALSE; + } data_size = (int)data_len; data_str = zend_string_alloc(data_size, 0); memset(ZSTR_VAL(data_str), 0, data_size); @@ -695,6 +699,10 @@ PHP_FUNCTION(mdecrypt_generic) memset(data_s, 0, data_size); memcpy(data_s, data, data_len); } else { /* It's not a block algorithm */ + if (data_len > INT_MAX) { + php_error_docref(NULL, E_WARNING, "Data size too large, %d maximum", INT_MAX); + RETURN_FALSE; + } data_size = (int)data_len; data_s = emalloc(data_size + 1); memset(data_s, 0, data_size);