php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-18480: array_splice overflow on array length with offset.

Browse Source 
close GH-18483
This commit is contained in:
David Carlier
2025-05-02 07:11:57 +01:00
parent 0227d96f48
commit 8a585856d1
3 changed files with 50 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -2,6 +2,10 @@ PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.3.22
- Core:
. Fixed GH-18480 (array_splice with large values for offset/length arguments).
(nielsdos/David Carlier)
- Curl:
. Fixed GH-18460 (curl_easy_setopt with CURLOPT_USERPWD/CURLOPT_USERNAME/
CURLOPT_PASSWORD set the Authorization header when set to NULL).

12
ext/standard/array.c
View File

@@ -3252,7 +3252,7 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
/* If hash for removed entries exists, go until offset+length and copy the entries to it */
if (removed != NULL) {
for ( ; pos < offset + length && idx < in_hash->nNumUsed; idx++, entry++) {
for ( ; pos - offset < length && idx < in_hash->nNumUsed; idx++, entry++) {
if (Z_TYPE_P(entry) == IS_UNDEF) continue;
pos++;
Z_TRY_ADDREF_P(entry);
@@ -3260,9 +3260,9 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
zend_hash_packed_del_val(in_hash, entry);
}
} else { /* otherwise just skip those entries */
int pos2 = pos;
zend_long pos2 = pos;
for ( ; pos2 < offset + length && idx < in_hash->nNumUsed; idx++, entry++) {
for ( ; pos2 - offset < length && idx < in_hash->nNumUsed; idx++, entry++) {
if (Z_TYPE_P(entry) == IS_UNDEF) continue;
pos2++;
zend_hash_packed_del_val(in_hash, entry);
@@ -3317,7 +3317,7 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
/* If hash for removed entries exists, go until offset+length and copy the entries to it */
if (removed != NULL) {
for ( ; pos < offset + length && idx < in_hash->nNumUsed; idx++, p++) {
for ( ; pos - offset < length && idx < in_hash->nNumUsed; idx++, p++) {
if (Z_TYPE(p->val) == IS_UNDEF) continue;
pos++;
entry = &p->val;
@@ -3330,9 +3330,9 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
zend_hash_del_bucket(in_hash, p);
}
} else { /* otherwise just skip those entries */
int pos2 = pos;
zend_long pos2 = pos;
for ( ; pos2 < offset + length && idx < in_hash->nNumUsed; idx++, p++) {
for ( ; pos2 - offset < length && idx < in_hash->nNumUsed; idx++, p++) {
if (Z_TYPE(p->val) == IS_UNDEF) continue;
pos2++;
zend_hash_del_bucket(in_hash, p);

40
ext/standard/tests/array/gh18480.phpt Normal file
View File

@@ -0,0 +1,40 @@
--TEST--
GH-18480 (array_splice overflow with large offset / length values)
--FILE--
<?php
foreach ([PHP_INT_MIN, PHP_INT_MAX] as $length) {
$a = [PHP_INT_MAX];
$offset = PHP_INT_MAX;
var_dump(array_splice($a,$offset, $length));
$a = [PHP_INT_MAX];
$offset = PHP_INT_MIN;
var_dump(array_splice($a,$offset, $length));
$a = ["a" => PHP_INT_MAX];
$offset = PHP_INT_MAX;
var_dump(array_splice($a,$offset, $length));
$a = ["a" => PHP_INT_MAX];
$offset = PHP_INT_MIN;
var_dump(array_splice($a,$offset, $length));
}
--EXPECTF--
array(0) {
}
array(0) {
}
array(0) {
}
array(0) {
}
array(0) {
}
array(1) {
[0]=>
int(%d)
}
array(0) {
}
array(1) {
["a"]=>
int(%d)
}