php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-27 17:52:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #69248 - heap overflow vulnerability in regcomp.c

Browse Source 
Merged from 70bc296560
This commit is contained in:
Stanislav Malyshev
2015-03-17 17:04:57 -07:00
parent 8b14d3052f
commit fb04dcf6db
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@@ -8,6 +8,9 @@ PHP NEWS
configuration options). (Anatol Belski)
. Fixed bug #69207 (move_uploaded_file allows nulls in path). (Stas)
- Ereg:
. Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (Stas)
- SOAP:
. Fixed bug #69085 (SoapClient's __call() type confusion through
unserialize()). (Dmitry)

10
ext/ereg/regex/regcomp.c
View File

@@ -117,7 +117,15 @@ int cflags;
(NC-1)*sizeof(cat_t));
if (g == NULL)
return(REG_ESPACE);
p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
{
/* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */
size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) {
free((char *) g);
return REG_INVARG;
}
p->ssize = new_ssize;
}
p->strip = (sop *)malloc(p->ssize * sizeof(sop));
p->slen = 0;
if (p->strip == NULL) {