com php-src: Fix bug #73276 - crash in openssl_random_pseud o_bytes function: ext/openssl/openssl.c

Commit: fe789b3f7c414954a47ccb6cee17b19f56ab1b98 Author: Stanislav Malyshev <stas@php.net> Tue, 11 Oct 2016 13:37:47 -0700 Committer: Anatol Belski <ab@php.net> Fri, 14 Oct 2016 01:42:19 +0200 Parents: e7e60851ae2a3ce47a317b93e080e4daa7120934 Branches: PHP-7.1 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=fe789b3f7c414954a47ccb6cee17b19f56ab1b98 Log: Fix bug #73276 - crash in openssl_random_pseudo_bytes function (cherry picked from commit 85a22a0af0722ef3a8d49a056a0b2b18be1fb981) (cherry picked from commit 7dc8b5e7aefce963a7a222c48ee3506725c4776b) Bugs: https://bugs.php.net/73276 Changed paths: M ext/openssl/openssl.c Diff: diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index 9198530..7fbbbe8 100644 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -6458,7 +6458,11 @@ PHP_FUNCTION(openssl_random_pseudo_bytes) return; } - if (buffer_length <= 0) { + if (buffer_length <= 0 +#ifndef PHP_WIN32 + || ZEND_LONG_INT_OVFL(buffer_length) +#endif + ) { RETURN_FALSE; } @@ -6482,6 +6486,7 @@ PHP_FUNCTION(openssl_random_pseudo_bytes) PHP_OPENSSL_CHECK_LONG_TO_INT(buffer_length, length); PHP_OPENSSL_RAND_ADD_TIME(); + /* FIXME loop if requested size > INT_MAX */ if (RAND_bytes((unsigned char*)ZSTR_VAL(buffer), (int)buffer_length) <= 0) { zend_string_release(buffer); if (zstrong_result_returned) {