Browse Source

Fix bug #74603 - use correct buffer size

pull/2610/merge
Stanislav Malyshev 9 years ago
parent
commit
5f8380d33e
  1. 1
      Zend/tests/bug74603.ini
  2. 15
      Zend/tests/bug74603.phpt
  3. 2
      Zend/zend_ini_parser.y

1
Zend/tests/bug74603.ini

@ -0,0 +1 @@
0=0&~2000000000

15
Zend/tests/bug74603.phpt

@ -0,0 +1,15 @@
--TEST--
Bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability)
--SKIPIF--
<?php
if (PHP_INT_MAX !== 2147483647)
die('skip for 32-bit only');
--FILE--
<?php
var_dump(parse_ini_file(__DIR__ . "/bug74603.ini", true, INI_SCANNER_NORMAL));
?>
--EXPECT--
array(1) {
[0]=>
string(1) "0"
}

2
Zend/zend_ini_parser.y

@ -53,7 +53,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
{
int i_result;
int i_op1, i_op2;
char str_result[MAX_LENGTH_OF_LONG];
char str_result[MAX_LENGTH_OF_LONG+1];
i_op1 = atoi(Z_STRVAL_P(op1));
free(Z_STRVAL_P(op1));

Loading…
Cancel
Save