From 95c4564f939c916538579ef63602a3cd31941c51 Mon Sep 17 00:00:00 2001
From: libnex <emmanuel.law@gmail.com>
Date: Mon, 29 May 2017 13:13:52 +0000
Subject: [PATCH] Fixed bug #73473: Stack Buffer Overflow in
 msgfmt_parse_message

---
 NEWS                                 | 3 +++
 ext/intl/msgformat/msgformat_parse.c | 1 +
 2 files changed, 4 insertions(+)

diff --git a/NEWS b/NEWS
index 5f4a72e2bb0..eecf1e50a6b 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,9 @@ PHP                                                                        NEWS
     properties). (Laruence)
   . Fixed misparsing of abstract unix domain socket names. (Sara)
 
+- Intl:
+  . Fixed bug #73473 (Stack Buffer Overflow in msgfmt_parse_message). (libnex)
+
 - Mbstring:
   . Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227,
     CVE-2017-9228, CVE-2017-9229) (Remi, Mamoru TASAKA)
diff --git a/ext/intl/msgformat/msgformat_parse.c b/ext/intl/msgformat/msgformat_parse.c
index 349633912b7..8562a76e92a 100644
--- a/ext/intl/msgformat/msgformat_parse.c
+++ b/ext/intl/msgformat/msgformat_parse.c
@@ -110,6 +110,7 @@ PHP_FUNCTION( msgfmt_parse_message )
 		RETURN_FALSE;
 	}
 
+	INTL_CHECK_LOCALE_LEN(slocale_len);
 	memset(mfo, 0, sizeof(*mfo));
 	msgformat_data_init(&mfo->mf_data);