Backported from 5.5 for 5.4 by Remi Collet From 97eff7eb57fc2320c267a949cffd622c38712484 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 22 May 2016 17:49:02 -0700 Subject: [PATCH] Fix bug #72241: get_icu_value_internal out-of-bounds read --- ext/intl/locale/locale_methods.c | 235 ++++++++++++++++++++------------------- ext/intl/tests/bug72241.phpt | 14 +++ 2 files changed, 132 insertions(+), 117 deletions(-) create mode 100644 ext/intl/tests/bug72241.phpt diff --git a/ext/intl/locale/locale_methods.c b/ext/intl/locale/locale_methods.c index c8159bc..31f60b3 100644 --- a/ext/intl/locale/locale_methods.c +++ b/ext/intl/locale/locale_methods.c @@ -329,6 +329,7 @@ static char* get_icu_value_internal( const char* loc_name , char* tag_name, int* if( U_FAILURE( status ) ) { if( status == U_BUFFER_OVERFLOW_ERROR ) { status = U_ZERO_ERROR; + buflen++; /* add space for \0 */ continue; } diff --git a/ext/intl/tests/bug72241.phpt b/ext/intl/tests/bug72241.phpt new file mode 100644 index 0000000..397e1e7 --- /dev/null +++ b/ext/intl/tests/bug72241.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #72241: get_icu_value_internal out-of-bounds read +--SKIPIF-- + +--FILE-- +