Fixed bug #73473: Stack Buffer Overflow in msgfmt_parse_message

9 years ago · 95c4564f93
2 changed files with 4 additions and 0 deletions
--- a/3
+++ b/3
@ -7,6 +7,9 @@ PHP                                                                        NEWS
    properties). (Laruence)
  . Fixed misparsing of abstract unix domain socket names. (Sara)

+- Intl:
+  . Fixed bug #73473 (Stack Buffer Overflow in msgfmt_parse_message). (libnex)
+
 - Mbstring:
  . Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227,
    CVE-2017-9228, CVE-2017-9229) (Remi, Mamoru TASAKA)
--- a/ext/intl/msgformat/msgformat_parse.c
+++ b/ext/intl/msgformat/msgformat_parse.c
@ -110,6 +110,7 @@ PHP_FUNCTION( msgfmt_parse_message )
 		RETURN_FALSE;
 	}

+	INTL_CHECK_LOCALE_LEN(slocale_len);
 	memset(mfo, 0, sizeof(*mfo));
 	msgformat_data_init(&mfo->mf_data);