archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-7.0' into PHP-7.1

Browse source
This commit is contained in:
Jakub Zelenka 2016-08-14 14:01:36 +01:00
commit 37c12f8f86
2 changed files with 25 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
ext/json/json.c
View file

@ -258,6 +258,16 @@ static PHP_FUNCTION(json_decode)
RETURN_NULL();
}
if (depth <= 0) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Depth must be greater than zero");
RETURN_NULL();
}
if (depth > INT_MAX) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Depth must be lower than %d", INT_MAX);
RETURN_NULL();
}
/* For BC reasons, the bool $assoc overrides the long $options bit for PHP_JSON_OBJECT_AS_ARRAY */
if (assoc) {
options |= PHP_JSON_OBJECT_AS_ARRAY;

15
ext/json/tests/bug72787.phpt Normal file
View file

@ -0,0 +1,15 @@
--TEST--
Bug #72787 (json_decode reads out of bounds)
--SKIPIF--
<?php if (!extension_loaded("json")) print "skip"; ?>
<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); ?>
--FILE--
<?php
var_dump(json_decode('[]', false, 0x100000000));
?>
--EXPECTF--
Warning: json_decode(): Depth must be lower than %d in %s on line %d
NULL