com php-src: Fix bug #72541 - size_t overflow lead to heap corruption: ext/curl/interface.c
| From: | Stanislav Malyshev | Date: | Wed, 13 Jul 2016 05:59:19 +0000 |
| Subject: | com php-src: Fix bug #72541 - size_t overflow lead to heap corruption: ext/curl/interface.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-93114@lists.php.net to get a copy of this message | ||
Commit: 2ca8d85dd4ac6d5f8c046f339f9636e3099b0f08
Author: Stanislav Malyshev <stas@php.net> Tue, 12 Jul 2016 22:59:19 -0700
Parents: 8bd8a64db64fd1bd89aa0f10b4214f576e72a8a2
Branches: PHP-7.0
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=2ca8d85dd4ac6d5f8c046f339f9636e3099b0f08
Log:
Fix bug #72541 - size_t overflow lead to heap corruption
Bugs:
https://bugs.php.net/72541
Changed paths:
M ext/curl/interface.c
Diff:
diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index 6a61641..7d085de 100644
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -3595,6 +3595,10 @@ PHP_FUNCTION(curl_unescape)
RETURN_FALSE;
}
+ if (str_len > INT_MAX) {
+ RETURN_FALSE;
+ }
+
if ((out = curl_easy_unescape(ch->cp, str, str_len, &out_len))) {
RETVAL_STRINGL(out, out_len);
curl_free(out);