archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix #74960: Heap buffer overflow via str_repeat

Browse source 
Trying to allocate a `zend_string` with a length only slighty smaller
than `SIZE_MAX` causes an integer overflow, so callers may need to
check that explicitly.  To make that easy in a portable way, we
introduce `ZSTR_MAX_LEN`.

Closes GH-7294.
This commit is contained in:
Christoph M. Becker 2021-07-21 13:55:13 +02:00
parent 2d2c001ca5
commit 760ff841a1
No known key found for this signature in database
GPG key ID: D66C9593118BCCB6
3 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -15,6 +15,7 @@ PHP NEWS
. Fixed bug #72146 (Integer overflow on substr_replace). (cmb) . Fixed bug #72146 (Integer overflow on substr_replace). (cmb)
. Fixed bug #81265 (getimagesize returns 0 for 256px ICO images). . Fixed bug #81265 (getimagesize returns 0 for 256px ICO images).
(George Dietrich) (George Dietrich)
. Fixed bug #74960 (Heap buffer overflow via str_repeat). (cmb, Dmitry)
29 Jul 2021, PHP 7.4.22 29 Jul 2021, PHP 7.4.22

2
Zend/zend_operators.c
View file

@ -1882,7 +1882,7 @@ ZEND_API int ZEND_FASTCALL concat_function(zval *result, zval *op1, zval *op2) /
size_t result_len = op1_len + op2_len; size_t result_len = op1_len + op2_len;
zend_string *result_str; zend_string *result_str;
if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) { if (UNEXPECTED(op1_len > ZSTR_MAX_LEN - op2_len)) {
zend_throw_error(NULL, "String size overflow"); zend_throw_error(NULL, "String size overflow");
zval_ptr_dtor_str(&op1_copy); zval_ptr_dtor_str(&op1_copy);
zval_ptr_dtor_str(&op2_copy); zval_ptr_dtor_str(&op2_copy);

2
Zend/zend_string.h
View file

@ -75,6 +75,8 @@ END_EXTERN_C()
#define _ZSTR_STRUCT_SIZE(len) (_ZSTR_HEADER_SIZE + len + 1) #define _ZSTR_STRUCT_SIZE(len) (_ZSTR_HEADER_SIZE + len + 1)
#define ZSTR_MAX_LEN (SIZE_MAX - ZEND_MM_ALIGNED_SIZE(_ZSTR_HEADER_SIZE + 1))
#define ZSTR_ALLOCA_ALLOC(str, _len, use_heap) do { \ #define ZSTR_ALLOCA_ALLOC(str, _len, use_heap) do { \
(str) = (zend_string *)do_alloca(ZEND_MM_ALIGNED_SIZE_EX(_ZSTR_STRUCT_SIZE(_len), 8), (use_heap)); \ (str) = (zend_string *)do_alloca(ZEND_MM_ALIGNED_SIZE_EX(_ZSTR_STRUCT_SIZE(_len), 8), (use_heap)); \
GC_SET_REFCOUNT(str, 1); \ GC_SET_REFCOUNT(str, 1); \