php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-16360 mb_substr overflow on start and length arguments.

Browse Source 
occurs when they are negated to start working from the end instead
when set with ZEND_LONG_MIN.
This commit is contained in:
David Carlier
2024-10-11 05:42:03 +01:00
parent e2e2b3ab62
commit c34d4fbbf4
3 changed files with 37 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -17,6 +17,10 @@ PHP NEWS
. Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
(nielsdos)
- MBstring:
. Fixed bug GH-16361 (mb_substr overflow on start/length arguments).
(David Carlier)
- PHPDBG:
. Fixed bug GH-16174 (Empty string is an invalid expression for ev). (cmb)

10
ext/mbstring/mbstring.c
View File

@@ -2172,6 +2172,16 @@ PHP_FUNCTION(mb_substr)
Z_PARAM_STR_OR_NULL(encoding)
ZEND_PARSE_PARAMETERS_END();
if (from == ZEND_LONG_MIN) {
zend_argument_value_error(2, "must be between " ZEND_LONG_FMT " and " ZEND_LONG_FMT, (ZEND_LONG_MIN + 1), ZEND_LONG_MAX);
RETURN_THROWS();
}
if (!len_is_null && len == ZEND_LONG_MIN) {
zend_argument_value_error(3, "must be between " ZEND_LONG_FMT " and " ZEND_LONG_FMT, (ZEND_LONG_MIN + 1), ZEND_LONG_MAX);
RETURN_THROWS();
}
string.encoding = php_mb_get_encoding(encoding, 4);
if (!string.encoding) {
RETURN_THROWS();

23
ext/mbstring/tests/gh16360.phpt Normal file
View File

@@ -0,0 +1,23 @@
--TEST--
GH-16320 mb_substr overflow from negative length
--EXTENSIONS--
mbstring
--FILE--
<?php
try {
mb_substr("abcd", PHP_INT_MIN, 4, "UTF-8");
} catch (\ValueError $e) {
echo $e->getMessage() . PHP_EOL;
}
try {
mb_substr("abcd", 0, PHP_INT_MIN, "UTF-8");
} catch (\ValueError $e) {
echo $e->getMessage() . PHP_EOL;
}
var_dump(mb_substr("abcd", PHP_INT_MAX, PHP_INT_MAX, "UTF-8"));
?>
--EXPECTF--
mb_substr(): Argument #2 ($start) must be between %s and %s
mb_substr(): Argument #3 ($length) must be between %s and %s
string(0) ""