com php-src: Bug #73218: add mitigation for ICU int overflow: ext/intl/resourcebundle/resourcebundle_class.c

Commit: b26b02b2df95eaa647ea3f4e7b42bd11eea4ed2c Author: Stanislav Malyshev <stas@php.net> Tue, 4 Oct 2016 22:40:09 -0700 Committer: Anatol Belski <ab@php.net> Wed, 12 Oct 2016 13:22:51 +0200 Parents: 87a8240b5adc730153e6df54f33195aee1325e6f Branches: PHP-7.0 PHP-7.1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=b26b02b2df95eaa647ea3f4e7b42bd11eea4ed2c Log: Bug #73218: add mitigation for ICU int overflow (cherry picked from commit d946d102936525bc7dcd01f3827d0a6e0bb971b0) Bugs: https://bugs.php.net/73218 Changed paths: M ext/intl/resourcebundle/resourcebundle_class.c Diff: diff --git a/ext/intl/resourcebundle/resourcebundle_class.c b/ext/intl/resourcebundle/resourcebundle_class.c index fd255d5..47d9bf0 100644 --- a/ext/intl/resourcebundle/resourcebundle_class.c +++ b/ext/intl/resourcebundle/resourcebundle_class.c @@ -101,6 +101,13 @@ static int resourcebundle_ctor(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_constr locale = intl_locale_get_default(); } + if (bundlename_len >= MAXPATHLEN) { + intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "Bundle name too long", 0 ); + zval_dtor(return_value); + ZVAL_NULL(return_value); + return FAILURE; + } + if (fallback) { rb->me = ures_open(bundlename, locale, &INTL_DATA_ERROR_CODE(rb)); } else { @@ -331,6 +338,11 @@ PHP_FUNCTION( resourcebundle_locales ) RETURN_FALSE; } + if (bundlename_len >= MAXPATHLEN) { + intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "resourcebundle_locales: bundle name too long", 0 ); + RETURN_FALSE; + } + if(bundlename_len == 0) { // fetch default locales list bundlename = NULL;