diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-10-11 16:26:35 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2016-10-11 16:26:35 -0700 |
| commit | 689a9b8def07875641b3132a82c701fb7acb676c (patch) | |
| tree | 22120cf5e4c46ede692518256e8019178e90c1a8 /ext/bcmath/libbcmath/src/init.c | |
| parent | 4165d976066129000d947ffa3be73f91e9867635 (diff) | |
| parent | 082d1f237531ab71c3050dfb9f598344f654d9e1 (diff) | |
| download | php-git-689a9b8def07875641b3132a82c701fb7acb676c.tar.gz | |
Merge branch 'PHP-5.6.27' into PHP-5.6
* PHP-5.6.27:
Fix tests
fix tsrm
Fix bug #73284 - heap overflow in php_ereg_replace function
Fix bug #73276 - crash in openssl_random_pseudo_bytes function
Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML()
fix bug #73275 - crash in openssl_encrypt function
Fix for #73240 - Write out of bounds at number_format
Bug #73218: add mitigation for ICU int overflow
Add more locale length checks, due to ICU bugs.
Fix bug #73208 - another missing length check
Fix bug #73190: memcpy negative parameter _bc_new_num_ex
Fix bug #73189 - Memcpy negative size parameter php_resolve_path
Fixed bug #73174 - heap overflow in php_pcre_replace_impl
Fix bug #73150: missing NULL check in dom_document_save_html
Fix bug #73147: Use After Free in PHP7 unserialize()
Fix bug #73082
Fix bug #73073 - CachingIterator null dereference when convert to string
Diffstat (limited to 'ext/bcmath/libbcmath/src/init.c')
| -rw-r--r-- | ext/bcmath/libbcmath/src/init.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/ext/bcmath/libbcmath/src/init.c b/ext/bcmath/libbcmath/src/init.c index 986ad1df24..c51133be73 100644 --- a/ext/bcmath/libbcmath/src/init.c +++ b/ext/bcmath/libbcmath/src/init.c @@ -49,7 +49,10 @@ _bc_new_num_ex (length, scale, persistent) int length, scale, persistent; { bc_num temp; - + /* PHP Change: add length check */ + if ((size_t)length+(size_t)scale > INT_MAX) { + zend_error(E_ERROR, "Result too long, max is %d", INT_MAX); + } /* PHP Change: malloc() -> pemalloc(), removed free_list code */ temp = (bc_num) safe_pemalloc (1, sizeof(bc_struct)+length, scale, persistent); #if 0 |