[PHP-CVS] cvs: php-src(PHP_5_2) /ext/standard string.c

[Ilia Alshanetsky]

iliaa           Thu Mar  8 00:06:41 2007 UTC

  Modified files:              (Branch: PHP_5_2)
    /php-src/ext/standard       string.c 
  Log:
  Improved offset validation
  
  
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.46&r2=1.445.2.14.2.47&diff_format=u
Index: php-src/ext/standard/string.c
diff -u php-src/ext/standard/string.c:1.445.2.14.2.46 
php-src/ext/standard/string.c:1.445.2.14.2.47
--- php-src/ext/standard/string.c:1.445.2.14.2.46       Wed Mar  7 18:15:46 2007
+++ php-src/ext/standard/string.c       Thu Mar  8 00:06:41 2007
@@ -18,7 +18,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: string.c,v 1.445.2.14.2.46 2007/03/07 18:15:46 stas Exp $ */
+/* $Id: string.c,v 1.445.2.14.2.47 2007/03/08 00:06:41 iliaa Exp $ */
 
 /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */
 
@@ -4642,11 +4642,13 @@
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset 
should be greater than or equal to 0.");
                        RETURN_FALSE;           
                }
-               p += Z_LVAL_PP(offset);
-               if (p > endp) {
+
+               if (Z_LVAL_PP(offset) > Z_STRLEN_PP(haystack)) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset 
value %ld exceeds string length.", Z_LVAL_PP(offset));
                        RETURN_FALSE;           
                }
+               p += Z_LVAL_PP(offset);
+
                if (ac == 4) {
                        convert_to_long_ex(length);
                        if (Z_LVAL_PP(length) <= 0) {

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php