archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 14:08:47 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix #79371: mb_strtolower (UTF-32LE): stack-buffer-overflow

Browse source 
We make sure that negative values are properly compared.
This commit is contained in:
Christoph M. Becker 2020-03-12 13:04:04 +01:00 • committed by Stanislav Malyshev
parent 902e19ddf3
commit ebdaeb8572
2 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
ext/mbstring/php_unicode.c
View file

@ -313,7 +313,7 @@ static int convert_case_filter(int c, void *void_data)
/* Handle invalid characters early, as we assign special meaning to /* Handle invalid characters early, as we assign special meaning to
* codepoints above 0xffffff. */ * codepoints above 0xffffff. */
if (UNEXPECTED(c > 0xffffff)) { if (UNEXPECTED((unsigned) c > 0xffffff)) {
(*data->next_filter->filter_function)(c, data->next_filter); (*data->next_filter->filter_function)(c, data->next_filter);
return 0; return 0;
} }

14
ext/mbstring/tests/bug79371.phpt Normal file
View file

@ -0,0 +1,14 @@
--TEST--
Bug #79371 (mb_strtolower (UTF-32LE): stack-buffer-overflow)
--SKIPIF--
<?php
if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
?>
--FILE--
<?php
$bytes = array(0xef, 0xbf, 0xbd, 0xef);
$str = implode(array_map("chr", $bytes));
var_dump(bin2hex(mb_strtolower($str, "UTF-32LE")));
?>
--EXPECT--
string(8) "3f000000"