archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-20 17:34:35 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixed Bug #63581 Possible buffer overflow

Browse source 
In fpm-log, possible buffer overflow. Check for length is done at
the beginning of the loop, so is not done when overflow occurs
on the last loop (len = 1024 or 1025). (ack from fat).

This issue where found from by static code analysis tool and, so,
I can't provide any reproducer.
This commit is contained in:
Remi Collet 2012-11-28 10:35:04 +01:00
parent f08060a48f
commit bc492007da
2 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
NEWS
View file

@ -21,6 +21,9 @@ PHP NEWS
. Fixed bug #63590 (Different results in TS and NTS under Windows). . Fixed bug #63590 (Different results in TS and NTS under Windows).
(Anatoliy) (Anatoliy)
- FPM:
. Fixed bug #63581 Possible null dereference and buffer overflow (Remi)
- Imap: - Imap:
. Fixed Bug #63126 DISABLE_AUTHENTICATOR ignores array (Remi) . Fixed Bug #63126 DISABLE_AUTHENTICATOR ignores array (Remi)

7
sapi/fpm/fpm/fpm_log.c
View file

@ -96,7 +96,7 @@ int fpm_log_init_child(struct fpm_worker_pool_s *wp) /* {{{ */
int fpm_log_write(char *log_format TSRMLS_DC) /* {{{ */ int fpm_log_write(char *log_format TSRMLS_DC) /* {{{ */
{ {
char *s, *b; char *s, *b;
char buffer[FPM_LOG_BUFFER]; char buffer[FPM_LOG_BUFFER+1];
int token, test; int token, test;
size_t len, len2; size_t len, len2;
struct fpm_scoreboard_proc_s proc, *proc_p; struct fpm_scoreboard_proc_s proc, *proc_p;
@ -146,9 +146,10 @@ int fpm_log_write(char *log_format TSRMLS_DC) /* {{{ */
s = log_format; s = log_format;
while (*s != '\0') { while (*s != '\0') {
if (len > FPM_LOG_BUFFER) { /* Test is we have place for 1 more char. */
if (len >= FPM_LOG_BUFFER) {
zlog(ZLOG_NOTICE, "the log buffer is full (%d). The access log request has been truncated.", FPM_LOG_BUFFER); zlog(ZLOG_NOTICE, "the log buffer is full (%d). The access log request has been truncated.", FPM_LOG_BUFFER);
len = FPM_LOG_BUFFER - 1; len = FPM_LOG_BUFFER;
break; break;
} }