archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix for bug #72807 - do not produce strings with negative length

Browse source
This commit is contained in:
Stanislav Malyshev 2016-08-11 23:36:25 -07:00
parent 5a34bd6d1e
commit 1cd6bc6463
2 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Zend/zend_API.h
View file

@ -578,6 +578,9 @@ END_EXTERN_C()
const char *__s=(s); \
zval *__z = (z); \
Z_STRLEN_P(__z) = strlen(__s); \
if (UNEXPECTED(Z_STRLEN_P(__z) < 0)) { \
zend_error(E_ERROR, "String size overflow"); \
} \
Z_STRVAL_P(__z) = (duplicate?estrndup(__s, Z_STRLEN_P(__z)):(char*)__s);\
Z_TYPE_P(__z) = IS_STRING; \
} while (0)

4
ext/curl/interface.c
View file

@ -3478,6 +3478,10 @@ PHP_FUNCTION(curl_escape)
ZEND_FETCH_RESOURCE(ch, php_curl *, &zid, -1, le_curl_name, le_curl);
if ((res = curl_easy_escape(ch->cp, str, str_len))) {
if (strlen(res) > INT_MAX) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Escaped string is too long, maximum is %d", INT_MAX);
RETURN_FALSE;
}
RETVAL_STRING(res, 1);
curl_free(res);
} else {