php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-29 19:23:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix buffer overflow bug in HZ text conversion code

Browse Source
This commit is contained in:
Alex Dowad
2022-05-22 18:00:01 +02:00
parent 0154a5ac9f
commit 1f17b5468f
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ext/mbstring/libmbfl/filters/mbfilter_hz.c
+4 -3
View File
@@ -372,7 +372,7 @@ static void mb_wchar_to_hz(uint32_t *in, size_t len, mb_convert_buf *buf, bool e
} else if (s < 0x80) {
/* ASCII */
if (buf->state != ASCII) {
MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 2);
MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 3);
out = mb_convert_buf_add2(out, '~', '}');
buf->state = ASCII;
}
@@ -385,11 +385,12 @@ static void mb_wchar_to_hz(uint32_t *in, size_t len, mb_convert_buf *buf, bool e
} else {
/* GB 2312-80 */
if (buf->state != GB2312) {
MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 2);
MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 4);
out = mb_convert_buf_add2(out, '~', '{');
buf->state = GB2312;
} else {
MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 2);
}
MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 2);
out = mb_convert_buf_add2(out, (s >> 8) & 0x7F, s & 0x7F);
}
}