diff options
| author | Stanislav Malyshev <stas@php.net> | 2015-05-12 14:26:06 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2015-05-12 14:26:06 -0700 |
| commit | 587ddf6ddccd707d67d48dccd4f4ca0a90224ac9 (patch) | |
| tree | cf67e35a6088482a23861f25fe8e01a3213bb717 /Zend/zend_operators.c | |
| parent | adbb301a70e16ada22f14a7e623b73d84580f12d (diff) | |
| parent | c08f9c2c786b0f7cbb401c18f6634cb5773f5baf (diff) | |
| download | php-git-587ddf6ddccd707d67d48dccd4f4ca0a90224ac9.tar.gz | |
Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
fix format
update NEWS
Add test for bug #69522
Update tests
Fix bug #69522 - do not allow int overflow
Forgot test file
Fix bug #69403 and other int overflows
Fixed bug #69418 - more s->p fixes for filenames
Fixed bug #69364 - use smart_str to assemble strings
Fix bug #69453 - don't try to cut empty string
Fix bug #69545 - avoid overflow when reading list
Conflicts:
ext/standard/pack.c
Diffstat (limited to 'Zend/zend_operators.c')
| -rw-r--r-- | Zend/zend_operators.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c index 242611643f..1013f26f61 100644 --- a/Zend/zend_operators.c +++ b/Zend/zend_operators.c @@ -1456,14 +1456,19 @@ ZEND_API int concat_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{ zend_error(E_ERROR, "String size overflow"); } - Z_STRVAL_P(result) = erealloc(Z_STRVAL_P(result), res_len+1); + Z_STRVAL_P(result) = safe_erealloc(Z_STRVAL_P(result), res_len, 1, 1); memcpy(Z_STRVAL_P(result)+Z_STRLEN_P(result), Z_STRVAL_P(op2), Z_STRLEN_P(op2)); Z_STRVAL_P(result)[res_len]=0; Z_STRLEN_P(result) = res_len; } else { int length = Z_STRLEN_P(op1) + Z_STRLEN_P(op2); - char *buf = (char *) emalloc(length + 1); + char *buf; + + if (Z_STRLEN_P(op1) < 0 || Z_STRLEN_P(op2) < 0 || (int) (Z_STRLEN_P(op1) + Z_STRLEN_P(op2)) < 0) { + zend_error(E_ERROR, "String size overflow"); + } + buf = (char *) safe_emalloc(length, 1, 1); memcpy(buf, Z_STRVAL_P(op1), Z_STRLEN_P(op1)); memcpy(buf + Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2)); |