php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-11476: crash with count_demerits negative-size-param

Browse Source 
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
This commit is contained in:
Alex Dowad
2023-06-19 21:50:30 +02:00
parent 4918765d54
commit 443927e3e8
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ext/mbstring/mbstring.c
View File

@@ -3083,8 +3083,9 @@ try_next_encoding:
if (strict) {
/* This candidate encoding is not valid, eliminate it from consideration */
length--;
if (length == 0) {
return 0;
if (i == length) {
/* The eliminated candidate was the last valid one in the list */
goto next_iteration;
}
memmove(&array[i], &array[i+1], (length - i) * sizeof(struct candidate));
goto try_next_encoding;
@@ -3100,6 +3101,7 @@ try_next_encoding:
}
}
}
next_iteration: ;
}
for (size_t i = 0; i < length; i++) {

12
ext/mbstring/tests/gh11476.phpt Normal file
View File

@@ -0,0 +1,12 @@
--TEST--
GH-11476: count_demerits negative-size-param
--EXTENSIONS--
mbstring
--FILE--
<?php
$str = str_repeat('a', 250) . chr(246) . str_repeat('a', 9) . chr(246) . str_repeat('a', 6);
$detectedEncoding = mb_detect_encoding($str, mb_list_encodings(), true);
var_dump($detectedEncoding);
?>
--EXPECT--
string(12) "Windows-1252"