archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 22:18:50 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

- Fixed possible unsigned int wrap around in html.c. Note that 5.3 has the same

Browse source 
(potential) problem; even though the code is substantially different, the
  variable name and the fashion it was incremented was kept.
This commit is contained in:
Gustavo André dos Santos Lopes 2012-02-05 14:57:57 +00:00
parent 6af0bdc2a3
commit 7dcada1c8c
1 changed files with 13 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

18
ext/standard/html.c
View file

@ -1257,9 +1257,13 @@ PHPAPI char *php_escape_html_entities_ex(unsigned char *old, size_t oldlen, size
maxlen = 128; maxlen = 128;
} else { } else {
maxlen = 2 * oldlen; maxlen = 2 * oldlen;
if (maxlen < oldlen) {
zend_error_noreturn(E_ERROR, "Input string is too long");
return NULL;
}
} }
replaced = emalloc(maxlen + 1); replaced = emalloc(maxlen + 1); /* adding 1 is safe: maxlen is even */
len = 0; len = 0;
cursor = 0; cursor = 0;
while (cursor < oldlen) { while (cursor < oldlen) {
@ -1271,8 +1275,9 @@ PHPAPI char *php_escape_html_entities_ex(unsigned char *old, size_t oldlen, size
/* guarantee we have at least 40 bytes to write. /* guarantee we have at least 40 bytes to write.
* In HTML5, entities may take up to 33 bytes */ * In HTML5, entities may take up to 33 bytes */
if (len + 40 > maxlen) { if (len > maxlen - 40) { /* maxlen can never be smaller than 128 */
replaced = erealloc(replaced, (maxlen += 128) + 1); replaced = safe_erealloc(replaced, maxlen , 1, 128 + 1);
maxlen += 128;
} }
if (status == FAILURE) { if (status == FAILURE) {
@ -1401,8 +1406,11 @@ encode_amp:
} }
/* checks passed; copy entity to result */ /* checks passed; copy entity to result */
/* entity size is unbounded, we may need more memory */ /* entity size is unbounded, we may need more memory */
if (maxlen < len + ent_len + 2 /* & and ; */) { /* at this point maxlen - len >= 40 */
replaced = erealloc(replaced, (maxlen += ent_len + 128) + 1); if (maxlen - len < ent_len + 2 /* & and ; */) {
/* ent_len < oldlen, which is certainly <= SIZE_MAX/2 */
replaced = safe_erealloc(replaced, maxlen, 1, ent_len + 128 + 1);
maxlen += ent_len + 128;
} }
replaced[len++] = '&'; replaced[len++] = '&';
memcpy(&replaced[len], &old[cursor], ent_len); memcpy(&replaced[len], &old[cursor], ent_len);