[PHP-CVS] cvs: php-src /ext/standard string.c /ext/standard/tests/strings chunk_split.phpt

[Ilia Alshanetsky]

iliaa           Wed May 30 00:38:00 2007 UTC

  Modified files:              
    /php-src/ext/standard/tests/strings chunk_split.phpt 
    /php-src/ext/standard       string.c 
  Log:
  
  MFB: Fixed an interger overflow inside chunk_split(), identified by
  Gerhard Wagner
  
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/tests/strings/chunk_split.phpt?r1=1.3&r2=1.4&diff_format=u
Index: php-src/ext/standard/tests/strings/chunk_split.phpt
diff -u php-src/ext/standard/tests/strings/chunk_split.phpt:1.3 
php-src/ext/standard/tests/strings/chunk_split.phpt:1.4
--- php-src/ext/standard/tests/strings/chunk_split.phpt:1.3     Sun Apr  3 
18:08:40 2005
+++ php-src/ext/standard/tests/strings/chunk_split.phpt Wed May 30 00:38:00 2007
@@ -6,6 +6,12 @@
 echo chunk_split('foooooooooooooooo', 5)."\n";
 echo chunk_split(str_repeat('X', 2*76))."\n";
 echo chunk_split("test", 10, "|end") . "\n";
+
+$a=str_repeat("B", 65535);
+$b=1;
+$c=str_repeat("B", 65535);
+var_dump(chunk_split($a,$b,$c));
+
 ?>
 --EXPECT--
 a-b-c-
@@ -18,3 +24,4 @@
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 
 test|end
+bool(false)
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.637&r2=1.638&diff_format=u
Index: php-src/ext/standard/string.c
diff -u php-src/ext/standard/string.c:1.637 php-src/ext/standard/string.c:1.638
--- php-src/ext/standard/string.c:1.637 Thu May 24 21:31:35 2007
+++ php-src/ext/standard/string.c       Wed May 30 00:38:00 2007
@@ -18,7 +18,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: string.c,v 1.637 2007/05/24 21:31:35 rasmus Exp $ */
+/* $Id: string.c,v 1.638 2007/05/30 00:38:00 iliaa Exp $ */
 
 /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */
 
@@ -3083,6 +3083,7 @@
        int chunks; /* complete chunks! */
        int restlen;
        int charsize = sizeof(char);
+       int out_len;
 
        if (str_type == IS_UNICODE) {
                charsize = sizeof(UChar);
@@ -3091,7 +3092,13 @@
        chunks = srclen / chunklen;
        restlen = srclen - chunks * chunklen; /* srclen % chunklen */
 
-       dest = safe_emalloc((srclen + (chunks + 1) * endlen + 1), charsize, 0);
+       out_len = (srclen + (chunks + 1) * endlen + 1);
+
+       if ((out_len > INT_MAX || out_len <= 0) || ((out_len * charsize) > 
INT_MAX || (out_len * charsize) <= 0)) {
+               return NULL;
+       }
+
+       dest = safe_emalloc(out_len, charsize, 0);
 
        for (p = src, q = dest; p < (src + charsize * (srclen - chunklen + 1)); 
) {
                memcpy(q, p, chunklen * charsize);

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php