diff options
| -rw-r--r-- | ext/session/session.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/ext/session/session.c b/ext/session/session.c index 1d60e08500..3d97c9e041 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -424,6 +424,11 @@ PS_SERIALIZER_DECODE_FUNC(php_binary) for (p = val; p < endptr; ) { zval **tmp; namelen = *p & (~PS_BIN_UNDEF); + + if (namelen > PS_BIN_MAX || (p + namelen) >= endptr) { + return FAILURE; + } + has_value = *p & PS_BIN_UNDEF ? 0 : 1; name = estrndup(p + 1, namelen); |