com php-src: Fix bug #73276 - crash in openssl_random_pseud o_bytes function: ext/openssl/openssl.c

Commit: 7dc8b5e7aefce963a7a222c48ee3506725c4776b Author: Stanislav Malyshev <stas@php.net> Tue, 11 Oct 2016 13:37:47 -0700 Committer: Anatol Belski <ab@php.net> Wed, 12 Oct 2016 15:55:42 +0200 Parents: 4ef79370a82d6c92f4ea0cd462274ba24e007f56 Branches: PHP-7.0 PHP-7.1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=7dc8b5e7aefce963a7a222c48ee3506725c4776b Log: Fix bug #73276 - crash in openssl_random_pseudo_bytes function (cherry picked from commit 85a22a0af0722ef3a8d49a056a0b2b18be1fb981) Bugs: https://bugs.php.net/73276 Changed paths: M ext/openssl/openssl.c Diff: diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index e2f9faf..bf1f0c5 100644 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -5546,7 +5546,11 @@ PHP_FUNCTION(openssl_random_pseudo_bytes) return; } - if (buffer_length <= 0) { + if (buffer_length <= 0 +#ifndef PHP_WIN32 + || ZEND_LONG_INT_OVFL(buffer_length) +#endif + ) { RETURN_FALSE; } @@ -5570,6 +5574,7 @@ PHP_FUNCTION(openssl_random_pseudo_bytes) PHP_OPENSSL_CHECK_LONG_TO_INT(buffer_length, length); PHP_OPENSSL_RAND_ADD_TIME(); + /* FIXME loop if requested size > INT_MAX */ if (RAND_bytes((unsigned char*)ZSTR_VAL(buffer), (int)buffer_length) <= 0) { zend_string_release(buffer); if (zstrong_result_returned) {