From 8b6a473e92cb71c2b5d5289c050dec5b83b5fd6f Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Wed, 9 Jan 2019 14:51:03 +0100 Subject: - core: Fix #77369 memcpy with negative length via crafted DNS response - mbstring: Fix #77370 buffer overflow on mb regex functions - fetch_token Fix #77371 heap buffer overflow in mb regex functions compile_string_node Fix #77381 heap buffer overflow in multibyte match_at Fix #77382 heap buffer overflow in expand_case_fold_string Fix #77385 buffer overflow in fetch_token Fix #77394 buffer overflow in multibyte case folding - unicode Fix #77418 heap overflow in utf32be_mbc_to_code - phar: Fix #77247 heap buffer overflow in phar_detect_phar_fname_ext - xmlrpc: Fix #77242 heap out of bounds read in xmlrpc_decode Fix #77380 global out of bounds read in xmlrpc base64 code --- php-bug77369.patch | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 php-bug77369.patch (limited to 'php-bug77369.patch') diff --git a/php-bug77369.patch b/php-bug77369.patch new file mode 100644 index 0000000..21fb348 --- /dev/null +++ b/php-bug77369.patch @@ -0,0 +1,42 @@ +Backported for 7.0 by Remi + + +From 8d3dfabef459fe7815e8ea2fd68753fd17859d7b Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev +Date: Sat, 29 Dec 2018 20:39:08 -0800 +Subject: [PATCH] Fix #77369 - memcpy with negative length via crafted DNS + response + +--- + ext/standard/dns.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/ext/standard/dns.c b/ext/standard/dns.c +index 8e102f816f6e..b5fbcb96f968 100644 +--- a/ext/standard/dns.c ++++ b/ext/standard/dns.c +@@ -459,6 +459,10 @@ static u_char *php_parserr(u_char *cp, u + GETLONG(ttl, cp); + GETSHORT(dlen, cp); + CHECKCP(dlen); ++ if (dlen == 0) { ++ /* No data in the response - nothing to do */ ++ return NULL; ++ } + if (type_to_fetch != T_ANY && type != type_to_fetch) { + cp += dlen; + return cp; +@@ -549,7 +553,12 @@ static u_char *php_parserr(u_char *cp, u + CHECKCP(n); + add_assoc_stringl(subarray, "tag", (char*)cp, n); + cp += n; +- add_assoc_string(subarray, "value", (char*)cp); ++ if ( (size_t) dlen < ((size_t)n) + 2 ) { ++ return NULL; ++ } ++ n = dlen - n - 2; ++ CHECKCP(n); ++ add_assoc_stringl(subarray, "value", (char*)cp, n); + break; + case DNS_T_TXT: + { -- cgit