php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-04 14:42:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-5.4' into PHP-5.5

Browse Source 
* PHP-5.4:
  update NEWS
  Fix bug #67249: printf out-of-bounds read
This commit is contained in:
Stanislav Malyshev
2014-05-27 12:10:03 -07:00
parent 3b8bdb7164 76b06780d5
commit a2f8c9c1ae
3 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@@ -27,6 +27,7 @@ PHP NEWS
. Fixed bug #67245 (usage of memcpy() with overlapping src and dst in
zend_exceptions.c). (Bob)
. Fixed bug #67247 (spl_fixedarray_resize integer overflow). (Stas)
. Fixed bug #67249 (printf out-of-bounds read). (Stas)
. Fixed bug #67250 (iptcparse out-of-bounds read). (Stas)
. Fixed bug #67252 (convert_uudecode out-of-bounds read). (Stas)

6
ext/standard/formatted_print.c
View File

@@ -376,6 +376,7 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
int alignment, currarg, adjusting, argnum, width, precision;
char *format, *result, padding;
int always_sign;
int format_len;
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "+", &args, &argc) == FAILURE) {
return NULL;
@@ -414,11 +415,12 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
convert_to_string_ex(args[format_offset]);
format = Z_STRVAL_PP(args[format_offset]);
format_len = Z_STRLEN_PP(args[format_offset]);
result = emalloc(size);
currarg = 1;
while (inpos<Z_STRLEN_PP(args[format_offset])) {
while (inpos<format_len) {
int expprec = 0, multiuse = 0;
zval *tmp;
@@ -473,7 +475,7 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
/* space padding, the default */
} else if (format[inpos] == '+') {
always_sign = 1;
} else if (format[inpos] == '\'') {
} else if (format[inpos] == '\'' && inpos+1<format_len) {
padding = format[++inpos];
} else {
PRINTF_DEBUG(("sprintf: end of modifiers\n"));

8
ext/standard/tests/strings/bug67249.phpt Normal file
View File

@@ -0,0 +1,8 @@
--TEST--
Bug #67249 (printf out-of-bounds read)
--FILE--
<?php
var_dump(sprintf("%'", "foo"));
?>
--EXPECT--
string(0) ""