summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDmitry Stogov <dmitry@zend.com>2013-11-27 14:58:35 +0400
committerDmitry Stogov <dmitry@zend.com>2013-11-27 14:58:35 +0400
commit65803c8faca4e106cf01d07c4d0dd7b97916711b (patch)
treee4d0c89497190115465592f247eb7fc4ea3e5a1f
parent92b76680e9489d1872e4a29cefd98d28cfb7409a (diff)
parent0dfdb1a491463e11760cc3927c31e4e27084cfdb (diff)
downloadphp-git-65803c8faca4e106cf01d07c4d0dd7b97916711b.tar.gz
Merge branch 'PHP-5.5' of git.php.net:php-src into PHP-5.5
* 'PHP-5.5' of git.php.net:php-src: NEWS Fixed bug #66060 (Heap buffer over-read in DateInterval)
-rw-r--r--NEWS3
-rw-r--r--ext/date/lib/parse_iso_intervals.c4
-rw-r--r--ext/date/lib/parse_iso_intervals.re2
3 files changed, 6 insertions, 3 deletions
diff --git a/NEWS b/NEWS
index 36126b8465..b3c8adfe94 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? 2013, PHP 5.5.8
+- Date:
+ . Fixed bug #66060 (Heap buffer over-read in DateInterval). (Remi)
+
?? ??? 2013, PHP 5.5.7
- CLI server:
diff --git a/ext/date/lib/parse_iso_intervals.c b/ext/date/lib/parse_iso_intervals.c
index fedad043c4..e669c855a4 100644
--- a/ext/date/lib/parse_iso_intervals.c
+++ b/ext/date/lib/parse_iso_intervals.c
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Sun Mar 31 10:48:17 2013 */
+/* Generated by re2c 0.13.5 on Wed Nov 27 11:14:23 2013 */
#line 1 "ext/date/lib/parse_iso_intervals.re"
/*
+----------------------------------------------------------------------+
@@ -380,7 +380,7 @@ yy6:
break;
}
ptr++;
- } while (*ptr);
+ } while (!s->errors->error_count && *ptr);
s->have_period = 1;
TIMELIB_DEINIT;
return TIMELIB_PERIOD;
diff --git a/ext/date/lib/parse_iso_intervals.re b/ext/date/lib/parse_iso_intervals.re
index e50ab37d3b..cbbf8781bf 100644
--- a/ext/date/lib/parse_iso_intervals.re
+++ b/ext/date/lib/parse_iso_intervals.re
@@ -348,7 +348,7 @@ isoweek = year4 "-"? "W" weekofyear;
break;
}
ptr++;
- } while (*ptr);
+ } while (!s->errors->error_count && *ptr);
s->have_period = 1;
TIMELIB_DEINIT;
return TIMELIB_PERIOD;