archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-17 14:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix bug #77370 - check that we do not read past buffer end when parsing multibytes

Browse source
This commit is contained in:
Stanislav Malyshev 2018-12-29 19:51:24 -08:00
parent a918020c03
commit 20407d06ca
2 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
ext/mbstring/oniguruma/regparse.c
View file

@ -246,6 +246,12 @@ strdup_with_null(OnigEncoding enc, UChar* s, UChar* end)
} }
#endif #endif
#if (defined (__GNUC__) && __GNUC__ > 2 ) && !defined(DARWIN) && !defined(__hpux) && !defined(_AIX)
# define UNEXPECTED(condition) __builtin_expect(condition, 0)
#else
# define UNEXPECTED(condition) (condition)
#endif
/* scan pattern methods */ /* scan pattern methods */
#define PEND_VALUE 0 #define PEND_VALUE 0
@ -260,14 +266,17 @@ strdup_with_null(OnigEncoding enc, UChar* s, UChar* end)
c = ONIGENC_MBC_TO_CODE(enc, p, end); \ c = ONIGENC_MBC_TO_CODE(enc, p, end); \
pfetch_prev = p; \ pfetch_prev = p; \
p += ONIGENC_MBC_ENC_LEN(enc, p); \ p += ONIGENC_MBC_ENC_LEN(enc, p); \
if(UNEXPECTED(p > end)) p = end; \
} while (0) } while (0)
#define PINC_S do { \ #define PINC_S do { \
p += ONIGENC_MBC_ENC_LEN(enc, p); \ p += ONIGENC_MBC_ENC_LEN(enc, p); \
if(UNEXPECTED(p > end)) p = end; \
} while (0) } while (0)
#define PFETCH_S(c) do { \ #define PFETCH_S(c) do { \
c = ONIGENC_MBC_TO_CODE(enc, p, end); \ c = ONIGENC_MBC_TO_CODE(enc, p, end); \
p += ONIGENC_MBC_ENC_LEN(enc, p); \ p += ONIGENC_MBC_ENC_LEN(enc, p); \
if(UNEXPECTED(p > end)) p = end; \
} while (0) } while (0)
#define PPEEK (p < end ? ONIGENC_MBC_TO_CODE(enc, p, end) : PEND_VALUE) #define PPEEK (p < end ? ONIGENC_MBC_TO_CODE(enc, p, end) : PEND_VALUE)

13
ext/mbstring/tests/bug77370.phpt Normal file
View file

@ -0,0 +1,13 @@
--TEST--
Bug #77370 (Buffer overflow on mb regex functions - fetch_token)
--SKIPIF--
<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
--FILE--
<?php
var_dump(mb_split(" \xfd",""));
?>
--EXPECT--
array(1) {
[0]=>
string(0) ""
}