iliaa Sun Dec 31 22:26:25 2006 UTC
Modified files: (Branch: PHP_4_4)
/php-src/ext/session session.c
Log:
MFH: Added boundary checks to php_binary deserializer
http://cvs.php.net/viewvc.cgi/php-src/ext/session/session.c?r1=1.336.2.53.2.10&r2=1.336.2.53.2.11&diff_format=u
Index: php-src/ext/session/session.c
diff -u php-src/ext/session/session.c:1.336.2.53.2.10
php-src/ext/session/session.c:1.336.2.53.2.11
--- php-src/ext/session/session.c:1.336.2.53.2.10 Tue Dec 26 17:23:33 2006
+++ php-src/ext/session/session.c Sun Dec 31 22:26:25 2006
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: session.c,v 1.336.2.53.2.10 2006/12/26 17:23:33 iliaa Exp $ */
+/* $Id: session.c,v 1.336.2.53.2.11 2006/12/31 22:26:25 iliaa Exp $ */
#ifdef HAVE_CONFIG_H
#include "config.h"
@@ -424,6 +424,11 @@
for (p = val; p < endptr; ) {
zval **tmp;
namelen = *p & (~PS_BIN_UNDEF);
+
+ if (namelen > PS_BIN_MAX || (p + namelen) >= endptr) {
+ return FAILURE;
+ }
+
has_value = *p & PS_BIN_UNDEF ? 0 : 1;
name = estrndup(p + 1, namelen);
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
