archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-18 23:18:56 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

MFH: Fix integer oveflow in strrpos()

Browse source
This commit is contained in:
Scott MacVicar 2008-07-22 01:10:58 +00:00
parent f349c14414
commit 6c48a01f40
2 changed files with 42 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
ext/standard/string.c
View file

@ -1842,7 +1842,7 @@ PHP_FUNCTION(strrpos)
p = haystack + offset; p = haystack + offset;
e = haystack + haystack_len - needle_len; e = haystack + haystack_len - needle_len;
} else { } else {
if (-offset > haystack_len) { if (-offset > haystack_len || offset < -INT_MAX) {
php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Offset is greater than the length of haystack string"); php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Offset is greater than the length of haystack string");
RETURN_FALSE; RETURN_FALSE;
} }

41
ext/standard/tests/strings/strrpos_offset.phpt Normal file
View file

@ -0,0 +1,41 @@
--TEST--
strrpos() offset integer overflow
--FILE--
<?php
var_dump(strrpos("t", "t", PHP_INT_MAX+1));
var_dump(strrpos("tttt", "tt", PHP_INT_MAX+1));
var_dump(strrpos(100, 101, PHP_INT_MAX+1));
var_dump(strrpos(1024, 1024, PHP_INT_MAX+1));
var_dump(strrpos(1024, 1024, -PHP_INT_MAX));
var_dump(strrpos(1024, "te", -PHP_INT_MAX));
var_dump(strrpos(1024, 1024, -PHP_INT_MAX-1));
var_dump(strrpos(1024, "te", -PHP_INT_MAX-1));
echo "Done\n";
?>
--EXPECTF--
Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d
bool(false)
Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d
bool(false)
Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d
bool(false)
Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d
bool(false)
Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d
bool(false)
Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d
bool(false)
Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d
bool(false)
Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d
bool(false)
Done