com php-src: Fix bug #74603 - use correct buffer size: Zend/tests/bug74603.ini Zend/tests/bug74603.phpt Zend/zend_in i_parser.y

Commit: 88c521d659521f695e0b9e7fcdded0fc1ee1c53b Author: Stanislav Malyshev <stas@php.net> Tue, 20 Jun 2017 00:09:01 -0700 Committer: Joe Watkins <krakjoe@php.net> Thu, 6 Jul 2017 07:43:43 +0100 Parents: 7378e7bdc8c3d7c7bbd7dc72bc5fb6cf724955a2 Branches: PHP-7.1.7 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=88c521d659521f695e0b9e7fcdded0fc1ee1c53b Log: Fix bug #74603 - use correct buffer size Bugs: https://bugs.php.net/74603 Changed paths: A Zend/tests/bug74603.ini A Zend/tests/bug74603.phpt M Zend/zend_ini_parser.y Diff: diff --git a/Zend/tests/bug74603.ini b/Zend/tests/bug74603.ini new file mode 100644 index 0000000..8d74a57 --- /dev/null +++ b/Zend/tests/bug74603.ini @@ -0,0 +1 @@ +0=0&~2000000000 diff --git a/Zend/tests/bug74603.phpt b/Zend/tests/bug74603.phpt new file mode 100644 index 0000000..b3194ec --- /dev/null +++ b/Zend/tests/bug74603.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability) +--SKIPIF-- +<?php +if (PHP_INT_MAX !== 2147483647) + die('skip for 32-bit only'); +--FILE-- +<?php +var_dump(parse_ini_file(__DIR__ . "/bug74603.ini", true, INI_SCANNER_NORMAL)); +?> +--EXPECT-- +array(1) { + [0]=> + string(1) "0" +} diff --git a/Zend/zend_ini_parser.y b/Zend/zend_ini_parser..y index 0a06f21..c44e14d 100644 --- a/Zend/zend_ini_parser.y +++ b/Zend/zend_ini_parser.y @@ -55,7 +55,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2) int i_result; int i_op1, i_op2; int str_len; - char str_result[MAX_LENGTH_OF_LONG]; + char str_result[MAX_LENGTH_OF_LONG+1]; i_op1 = atoi(Z_STRVAL_P(op1)); zend_string_free(Z_STR_P(op1));