com php-src: Fix possible overflow in json scanner utf8_inv alid_count: ext/json/json_scanner.c ext/json/json _scanner.re

Commit: f5b4cb7130e958eb7e68819353d81f8ff1117258 Author: Jakub Zelenka <bukka@php.net> Thu, 10 Aug 2017 19:40:02 +0100 Parents: 4375a6c5cd3c7ff47f1de548587de0c85233e48b Branches: PHP-7.2 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=f5b4cb7130e958eb7e68819353d81f8ff1117258 Log: Fix possible overflow in json scanner utf8_invalid_count Changed paths: M ext/json/json_scanner.c M ext/json/json_scanner.re Diff: diff --git a/ext/json/json_scanner..c b/ext/json/json_scanner.c index 786f302..5bc4416 100644 --- a/ext/json/json_scanner.c +++ b/ext/json/json_scanner.c @@ -639,9 +639,16 @@ yy79: yy80: { if (s->options & (PHP_JSON_INVALID_UTF8_IGNORE | PHP_JSON_INVALID_UTF8_SUBSTITUTE)) { - int utf8_addition = (s->options & PHP_JSON_INVALID_UTF8_SUBSTITUTE) ? 3 : 0; + if (s->options & PHP_JSON_INVALID_UTF8_SUBSTITUTE) { + if (s->utf8_invalid_count > INT_MAX - 2) { + s->errcode = PHP_JSON_ERROR_UTF8; + return PHP_JSON_T_ERROR; + } + s->utf8_invalid_count += 2; + } else { + s->utf8_invalid_count--; + } s->utf8_invalid = 1; - s->utf8_invalid_count += utf8_addition - 1; PHP_JSON_CONDITION_GOTO(STR_P1); } s->errcode = PHP_JSON_ERROR_UTF8; diff --git a/ext/json/json_scanner.re b/ext/json/json_scanner.re index e87790a..9d52307 100644 --- a/ext/json/json_scanner.re +++ b/ext/json/json_scanner.re @@ -281,9 +281,16 @@ std: <STR_P1>UTF8 { PHP_JSON_CONDITION_GOTO(STR_P1); } <STR_P1>ANY { if (s->options & (PHP_JSON_INVALID_UTF8_IGNORE | PHP_JSON_INVALID_UTF8_SUBSTITUTE)) { - int utf8_addition = (s->options & PHP_JSON_INVALID_UTF8_SUBSTITUTE) ? 3 : 0; + if (s->options & PHP_JSON_INVALID_UTF8_SUBSTITUTE) { + if (s->utf8_invalid_count > INT_MAX - 2) { + s->errcode = PHP_JSON_ERROR_UTF8; + return PHP_JSON_T_ERROR; + } + s->utf8_invalid_count += 2; + } else { + s->utf8_invalid_count--; + } s->utf8_invalid = 1; - s->utf8_invalid_count += utf8_addition - 1; PHP_JSON_CONDITION_GOTO(STR_P1); } s->errcode = PHP_JSON_ERROR_UTF8;