summaryrefslogtreecommitdiffstats
path: root/bug71906.patch
diff options
context:
space:
mode:
authorRemi Collet <fedora@famillecollet.com>2016-03-29 14:38:41 +0200
committerRemi Collet <fedora@famillecollet.com>2016-03-29 14:38:41 +0200
commit20725105f5fd5bbb19de56ac72576f9874138468 (patch)
tree4e8f9c06f22c49294bb297ab5949765dc274dd2e /bug71906.patch
parent6dfa2b2d9e32298dd65125133e68d23b2cce316a (diff)
php 5.4 security patches from 5.5.34 (WIP)
Diffstat (limited to 'bug71906.patch')
-rw-r--r--bug71906.patch55
1 files changed, 55 insertions, 0 deletions
diff --git a/bug71906.patch b/bug71906.patch
new file mode 100644
index 0000000..6a29692
--- /dev/null
+++ b/bug71906.patch
@@ -0,0 +1,55 @@
+Backported from 5.5 for 5.4 by Remi Collet
+
+From f8dd10508bd66b6eefb18d319577b443fb1e0c55 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas@php.net>
+Date: Mon, 28 Mar 2016 01:22:37 -0700
+Subject: [PATCH] Fixed bug #71906: AddressSanitizer: negative-size-param (-1)
+ in mbfl_strcut
+
+---
+ ext/mbstring/libmbfl/mbfl/mbfilter.c | 34 +++++++++++++++++-----------------
+ main/php_version.h | 6 +++---
+ 2 files changed, 20 insertions(+), 20 deletions(-)
+
+diff --git a/ext/mbstring/libmbfl/mbfl/mbfilter.c b/ext/mbstring/libmbfl/mbfl/mbfilter.c
+index 3b14727..4986472 100644
+--- a/ext/mbstring/libmbfl/mbfl/mbfilter.c
++++ b/ext/mbstring/libmbfl/mbfl/mbfilter.c
+@@ -1501,7 +1501,7 @@ mbfl_strcut(
+ if (encoding->flag & (MBFL_ENCTYPE_WCS2BE | MBFL_ENCTYPE_WCS2LE)) {
+ from &= -2;
+
+- if (from + length >= string->len) {
++ if (length >= string->len - from) {
+ length = string->len - from;
+ }
+
+@@ -1510,14 +1510,14 @@ mbfl_strcut(
+ } else if (encoding->flag & (MBFL_ENCTYPE_WCS4BE | MBFL_ENCTYPE_WCS4LE)) {
+ from &= -4;
+
+- if (from + length >= string->len) {
++ if (length >= string->len - from) {
+ length = string->len - from;
+ }
+
+ start = string->val + from;
+ end = start + (length & -4);
+ } else if ((encoding->flag & MBFL_ENCTYPE_SBCS)) {
+- if (from + length >= string->len) {
++ if (length >= string->len - from) {
+ length = string->len - from;
+ }
+
+@@ -1539,7 +1539,7 @@ mbfl_strcut(
+ start = p;
+
+ /* search end position */
+- if ((start - string->val) + length >= (int)string->len) {
++ if (length >= (int)string->len - (start - string->val)) {
+ end = string->val + string->len;
+ } else {
+ for (q = p + length; p < q; p += (m = mbtab[*p]));
+--
+2.1.4
+