From 9f1d962ed6057a3996f1b5aa82467a3172e41e8f Mon Sep 17 00:00:00 2001
From: Jakub Zelenka <bukka@php.net>
Date: Sun, 14 Aug 2016 13:52:59 +0100
Subject: [PATCH] Fixed bug #72787 (json_decode reads out of bounds)

---
 NEWS                         |  3 +++
 ext/json/json.c              |  6 ++++++
 ext/json/tests/bug72787.phpt | 15 +++++++++++++++
 3 files changed, 24 insertions(+)
 create mode 100644 ext/json/tests/bug72787.phpt

diff --git a/NEWS b/NEWS
index ccafb639910..6a4fa5001e6 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,9 @@ PHP                                                                        NEWS
   . Fixed bug #70195 (Cannot upload file using ftp_put to FTPES with
     require_ssl_reuse). (Benedict Singer)
 
+- JSON:
+  . Fixed bug #72787 (json_decode reads out of bounds). (Jakub Zelenka)
+
 - MSSQL:
   . Fixed bug #72039 (Use of uninitialised value on mssql_guid_string). (Kalle)
 
diff --git a/ext/json/json.c b/ext/json/json.c
index 634d6e55f5a..8c4d20fb2ab 100644
--- a/ext/json/json.c
+++ b/ext/json/json.c
@@ -704,6 +704,12 @@ PHP_JSON_API void php_json_decode_ex(zval *return_value, char *str, int str_len,
 		RETURN_NULL();
 	}
 
+	if (depth > INT_MAX) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Depth must be lower than %d", INT_MAX);
+		efree(utf16);
+		RETURN_NULL();
+	}
+
 	ALLOC_INIT_ZVAL(z);
 	jp = new_JSON_parser(depth);
 	if (parse_JSON_ex(jp, z, utf16, utf16_len, options TSRMLS_CC)) {
diff --git a/ext/json/tests/bug72787.phpt b/ext/json/tests/bug72787.phpt
new file mode 100644
index 00000000000..c9820faa9fa
--- /dev/null
+++ b/ext/json/tests/bug72787.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #72787 (json_decode reads out of bounds)
+--SKIPIF--
+<?php if (!extension_loaded("json")) print "skip"; ?>
+<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); ?>
+--FILE--
+<?php
+
+var_dump(json_decode('[]', false, 0x100000000));
+
+?>
+--EXPECTF--
+
+Warning: json_decode(): Depth must be lower than %d in %s on line %d
+NULL