php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-14 19:41:05 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #75981: prevent reading beyond buffer start

Browse Source
This commit is contained in:
Stanislav Malyshev
2018-02-20 15:34:43 -08:00
parent 67ec3ce1ec
commit 36239fee36
2 changed files with 34 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ext/standard/http_fopen_wrapper.c
View File

@@ -737,9 +737,9 @@ finish:
tmp_line, response_code);
}
}
if (tmp_line[tmp_line_len - 1] == '\n') {
if (tmp_line_len >= 1 && tmp_line[tmp_line_len - 1] == '\n') {
--tmp_line_len;
if (tmp_line[tmp_line_len - 1] == '\r') {
if (tmp_line_len >= 1 &&tmp_line[tmp_line_len - 1] == '\r') {
--tmp_line_len;
}
}

32
ext/standard/tests/http/bug75981.phpt Normal file
View File

@@ -0,0 +1,32 @@
--TEST--
Bug #75981 (stack-buffer-overflow while parsing HTTP response)
--INI--
allow_url_fopen=1
--SKIPIF--
<?php require 'server.inc'; http_server_skipif('tcp://127.0.0.1:12342'); ?>
--FILE--
<?php
require 'server.inc';
$options = [
'http' => [
'protocol_version' => '1.1',
'header' => 'Connection: Close'
],
];
$ctx = stream_context_create($options);
$responses = [
"data://text/plain,000000000100\xA\xA"
];
$pid = http_server('tcp://127.0.0.1:12342', $responses);
echo @file_get_contents('http://127.0.0.1:12342/', false, $ctx);
http_server_kill($pid);
?>
DONE
--EXPECT--
DONE