php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-29 03:32:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.0' into PHP-7.1

Browse Source 
* PHP-7.0:
  Add more mbfl string size checks (bug #73505)
This commit is contained in:
Stanislav Malyshev
2016-11-26 14:48:50 -08:00
parent 09085ac02c 58cdd03d92
commit dd7eee0609
2 changed files with 28 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c
View File

@@ -146,6 +146,10 @@ mbfl_memory_device_output(int c, void *data)
unsigned char *tmp;
newlen = device->length + device->allocsz;
if (newlen <= 0) {
/* overflow */
return -1;
}
tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
if (tmp == NULL) {
return -1;
@@ -169,6 +173,10 @@ mbfl_memory_device_output2(int c, void *data)
unsigned char *tmp;
newlen = device->length + device->allocsz;
if (newlen <= 0) {
/* overflow */
return -1;
}
tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
if (tmp == NULL) {
return -1;
@@ -194,6 +202,10 @@ mbfl_memory_device_output4(int c, void* data)
unsigned char *tmp;
newlen = device->length + device->allocsz;
if (newlen <= 0) {
/* overflow */
return -1;
}
tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
if (tmp == NULL) {
return -1;
@@ -227,6 +239,10 @@ mbfl_memory_device_strcat(mbfl_memory_device *device, const char *psrc)
if ((device->pos + len) >= device->length) {
/* reallocate buffer */
int newlen = device->length + (len + MBFL_MEMORY_DEVICE_ALLOC_SIZE)*sizeof(unsigned char);
if (newlen <= 0) {
/* overflow */
return -1;
}
unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
if (tmp == NULL) {
return -1;
@@ -254,6 +270,10 @@ mbfl_memory_device_strncat(mbfl_memory_device *device, const char *psrc, int len
if ((device->pos + len) >= device->length) {
/* reallocate buffer */
int newlen = device->length + len + MBFL_MEMORY_DEVICE_ALLOC_SIZE;
if (newlen <= 0) {
/* overflow */
return -1;
}
unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
if (tmp == NULL) {
return -1;
@@ -281,6 +301,10 @@ mbfl_memory_device_devcat(mbfl_memory_device *dest, mbfl_memory_device *src)
if ((dest->pos + src->pos) >= dest->length) {
/* reallocate buffer */
int newlen = dest->length + src->pos + MBFL_MEMORY_DEVICE_ALLOC_SIZE;
if (newlen <= 0) {
/* overflow */
return -1;
}
unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)dest->buffer, newlen*sizeof(unsigned char));
if (tmp == NULL) {
return -1;
@@ -336,6 +360,10 @@ mbfl_wchar_device_output(int c, void *data)
unsigned int *tmp;
newlen = device->length + device->allocsz;
if (newlen <= 0) {
/* overflow */
return -1;
}
tmp = (unsigned int *)mbfl_realloc((void *)device->buffer, newlen*sizeof(int));
if (tmp == NULL) {
return -1;

2
ext/standard/string.c
View File

@@ -20,8 +20,6 @@
/* $Id$ */
/* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */
#include <stdio.h>
#include "php.h"
#include "php_rand.h"