com php-src: Bug #73218: add mitigation for ICU int overflow: ext/intl/resourcebundle/resourcebundle_class.c

Commit: d25e427ab1a114c35dd129f18b99539eb50afd25 Author: Stanislav Malyshev <stas@php.net> Tue, 4 Oct 2016 22:40:09 -0700 Committer: Anatol Belski <ab@php.net> Fri, 14 Oct 2016 01:41:06 +0200 Parents: 0d9d133cd6318efc6a355397495cdfd38651500d Branches: PHP-7.1 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=d25e427ab1a114c35dd129f18b99539eb50afd25 Log: Bug #73218: add mitigation for ICU int overflow (cherry picked from commit d946d102936525bc7dcd01f3827d0a6e0bb971b0) (cherry picked from commit b26b02b2df95eaa647ea3f4e7b42bd11eea4ed2c) Bugs: https://bugs.php.net/73218 Changed paths: M ext/intl/resourcebundle/resourcebundle_class.c Diff: diff --git a/ext/intl/resourcebundle/resourcebundle_class.c b/ext/intl/resourcebundle/resourcebundle_class.c index fd255d5..47d9bf0 100644 --- a/ext/intl/resourcebundle/resourcebundle_class.c +++ b/ext/intl/resourcebundle/resourcebundle_class.c @@ -101,6 +101,13 @@ static int resourcebundle_ctor(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_constr locale = intl_locale_get_default(); } + if (bundlename_len >= MAXPATHLEN) { + intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "Bundle name too long", 0 ); + zval_dtor(return_value); + ZVAL_NULL(return_value); + return FAILURE; + } + if (fallback) { rb->me = ures_open(bundlename, locale, &INTL_DATA_ERROR_CODE(rb)); } else { @@ -331,6 +338,11 @@ PHP_FUNCTION( resourcebundle_locales ) RETURN_FALSE; } + if (bundlename_len >= MAXPATHLEN) { + intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "resourcebundle_locales: bundle name too long", 0 ); + RETURN_FALSE; + } + if(bundlename_len == 0) { // fetch default locales list bundlename = NULL;