php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-03 14:12:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #67249: printf out-of-bounds read

Browse Source
This commit is contained in:
Stanislav Malyshev
2014-05-11 18:44:14 -07:00
parent d400b74296
commit d780c2a673
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ext/standard/formatted_print.c
View File

@@ -379,6 +379,7 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
int alignment, currarg, adjusting, argnum, width, precision;
char *format, *result, padding;
int always_sign;
int format_len;
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "+", &args, &argc) == FAILURE) {
return NULL;
@@ -417,11 +418,12 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
convert_to_string_ex(args[format_offset]);
format = Z_STRVAL_PP(args[format_offset]);
format_len = Z_STRLEN_PP(args[format_offset]);
result = emalloc(size);
currarg = 1;
while (inpos<Z_STRLEN_PP(args[format_offset])) {
while (inpos<format_len) {
int expprec = 0, multiuse = 0;
zval *tmp;
@@ -476,7 +478,7 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
/* space padding, the default */
} else if (format[inpos] == '+') {
always_sign = 1;
} else if (format[inpos] == '\'') {
} else if (format[inpos] == '\'' && inpos+1<format_len) {
padding = format[++inpos];
} else {
PRINTF_DEBUG(("sprintf: end of modifiers\n"));

8
ext/standard/tests/strings/bug67249.phpt Normal file
View File

@@ -0,0 +1,8 @@
--TEST--
Bug #67249 (printf out-of-bounds read)
--FILE--
<?php
var_dump(sprintf("%'", "foo"));
?>
--EXPECT--
string(0) ""