diff options
Diffstat (limited to 'bug73240.patch')
| -rw-r--r-- | bug73240.patch | 141 |
1 files changed, 141 insertions, 0 deletions
diff --git a/bug73240.patch b/bug73240.patch new file mode 100644 index 0000000..9f0d435 --- /dev/null +++ b/bug73240.patch @@ -0,0 +1,141 @@ +Backported from 5.6.27 by Remi. + + +From 8259130b6bc752968856b352c9e7f8e03a8c0a8e Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev <stas@php.net> +Date: Mon, 10 Oct 2016 23:42:50 -0700 +Subject: [PATCH] Fix for #73240 - Write out of bounds at number_format + +--- + ext/standard/math.c | 108 +++++++++++++++++++++++++++++----------------------- + 1 file changed, 60 insertions(+), 48 deletions(-) + +diff --git a/ext/standard/math.c b/ext/standard/math.c +index 5ffeff7..8290b20 100644 +--- a/ext/standard/math.c ++++ b/ext/standard/math.c +@@ -1099,13 +1099,13 @@ PHPAPI char *_php_math_number_format(double d, int dec, char dec_point, char tho + + static char *_php_math_number_format_ex_len(double d, int dec, char *dec_point, + size_t dec_point_len, char *thousand_sep, size_t thousand_sep_len, +- int *result_len) ++ size_t *result_len) + { + char *tmpbuf = NULL, *resbuf; + char *s, *t; /* source, target */ + char *dp; +- int integral; +- int tmplen, reslen=0; ++ size_t integral; ++ size_t tmplen, reslen=0; + int count=0; + int is_negative=0; + +@@ -1144,15 +1144,23 @@ static char *_php_math_number_format_ex_len(double d, int dec, char *dec_point, + + /* allow for thousand separators */ + if (thousand_sep) { ++ if (integral + thousand_sep_len * ((integral-1) / 3) < integral) { ++ /* overflow */ ++ php_error_docref(NULL TSRMLS_CC, E_ERROR, "String overflow"); ++ } + integral += thousand_sep_len * ((integral-1) / 3); + } +- ++ + reslen = integral; +- ++ + if (dec) { + reslen += dec; + + if (dec_point) { ++ if (reslen + dec_point < dec_point) { ++ /* overflow */ ++ php_error_docref(NULL TSRMLS_CC, E_ERROR, "String overflow"); ++ } + reslen += dec_point_len; + } + } +@@ -1235,17 +1243,21 @@ PHP_FUNCTION(number_format) + char *thousand_sep = NULL, *dec_point = NULL; + char thousand_sep_chr = ',', dec_point_chr = '.'; + int thousand_sep_len = 0, dec_point_len = 0; +- ++ char *formatted; ++ size_t formatted_len; ++ + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "d|ls!s!", &num, &dec, &dec_point, &dec_point_len, &thousand_sep, &thousand_sep_len) == FAILURE) { + return; + } + + switch(ZEND_NUM_ARGS()) { + case 1: +- RETURN_STRING(_php_math_number_format(num, 0, dec_point_chr, thousand_sep_chr), 0); ++ formatted = _php_math_number_format(num, 0, dec_point_chr, thousand_sep_chr); ++ formatted_len = strlen(formatted); + break; + case 2: +- RETURN_STRING(_php_math_number_format(num, dec, dec_point_chr, thousand_sep_chr), 0); ++ formatted = _php_math_number_format(num, dec, dec_point_chr, thousand_sep_chr); ++ formatted_len = strlen(formatted); + break; + case 4: + if (dec_point == NULL) { +@@ -1258,15 +1270,15 @@ PHP_FUNCTION(number_format) + thousand_sep_len = 1; + } + +- Z_TYPE_P(return_value) = IS_STRING; +- Z_STRVAL_P(return_value) = _php_math_number_format_ex_len(num, dec, ++ formatted = _php_math_number_format_ex_len(num, dec, + dec_point, dec_point_len, thousand_sep, thousand_sep_len, +- &Z_STRLEN_P(return_value)); ++ &formatted_len); + break; + default: + WRONG_PARAM_COUNT; +- break; ++ return; + } ++ RETVAL_STRINGL_CHECK(formatted, formatted_len, 0); + } + /* }}} */ + +-- +2.1.4 + +From c1112ff323c9dd1a4596aa4272e918acf0f797eb Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev <stas@php.net> +Date: Tue, 11 Oct 2016 14:39:16 -0700 +Subject: [PATCH] fix tsrm + +--- + ext/standard/math.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/ext/standard/math.c b/ext/standard/math.c +index 8290b20..bb64425 100644 +--- a/ext/standard/math.c ++++ b/ext/standard/math.c +@@ -1146,7 +1146,7 @@ static char *_php_math_number_format_ex_len(double d, int dec, char *dec_point, + if (thousand_sep) { + if (integral + thousand_sep_len * ((integral-1) / 3) < integral) { + /* overflow */ +- php_error_docref(NULL TSRMLS_CC, E_ERROR, "String overflow"); ++ zend_error(E_ERROR, "String overflow"); + } + integral += thousand_sep_len * ((integral-1) / 3); + } +@@ -1159,7 +1159,7 @@ static char *_php_math_number_format_ex_len(double d, int dec, char *dec_point, + if (dec_point) { + if (reslen + dec_point < dec_point) { + /* overflow */ +- php_error_docref(NULL TSRMLS_CC, E_ERROR, "String overflow"); ++ zend_error(E_ERROR, "String overflow"); + } + reslen += dec_point_len; + } +-- +2.1.4 + |