-
-
Save anonymous/6eaf2bc74f9bc9db34cb4b10ed06b466 to your computer and use it in GitHub Desktop.
Patch for 72606
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
commit e6c48213c22ed50b2b987b479fcc1ac709394caa | |
Author: Stanislav Malyshev <stas@php.net> | |
Date: Mon Jul 18 21:44:39 2016 -0700 | |
Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c | |
diff --git a/ext/xmlrpc/libxmlrpc/simplestring.c b/ext/xmlrpc/libxmlrpc/simplestring.c | |
index a084d0e..6477734 100644 | |
--- a/ext/xmlrpc/libxmlrpc/simplestring.c | |
+++ b/ext/xmlrpc/libxmlrpc/simplestring.c | |
@@ -190,18 +190,31 @@ void simplestring_free(simplestring* string) { | |
* simplestring_add () | |
* SOURCE | |
*/ | |
-void simplestring_addn(simplestring* target, const char* source, int add_len) { | |
+void simplestring_addn(simplestring* target, const char* source, size_t add_len) { | |
+ size_t newsize = target->size, incr = 0; | |
if(target && source) { | |
if(!target->str) { | |
simplestring_init_str(target); | |
} | |
+ | |
+ if((SIZE_MAX - add_len) < target->len || (SIZE_MAX - add_len - 1) < target->len) { | |
+ /* check for overflows, if there's a potential overflow do nothing */ | |
+ return; | |
+ } | |
+ | |
if(target->len + add_len + 1 > target->size) { | |
/* newsize is current length + new length */ | |
- int newsize = target->len + add_len + 1; | |
- int incr = target->size * 2; | |
+ newsize = target->len + add_len + 1; | |
+ incr = target->size * 2; | |
/* align to SIMPLESTRING_INCR increments */ | |
+ if (incr) { | |
newsize = newsize - (newsize % incr) + incr; | |
+ } | |
+ if(newsize < (target->len + add_len + 1)) { | |
+ /* some kind of overflow happened */ | |
+ return; | |
+ } | |
target->str = (char*)realloc(target->str, newsize); | |
target->size = target->str ? newsize : 0; | |
diff --git a/ext/xmlrpc/libxmlrpc/simplestring.h b/ext/xmlrpc/libxmlrpc/simplestring.h | |
index c5d98cf..7e88cd0 100644 | |
--- a/ext/xmlrpc/libxmlrpc/simplestring.h | |
+++ b/ext/xmlrpc/libxmlrpc/simplestring.h | |
@@ -63,7 +63,7 @@ void simplestring_init(simplestring* string); | |
void simplestring_clear(simplestring* string); | |
void simplestring_free(simplestring* string); | |
void simplestring_add(simplestring* string, const char* add); | |
-void simplestring_addn(simplestring* string, const char* add, int add_len); | |
+void simplestring_addn(simplestring* string, const char* add, size_t add_len); | |
#ifdef __cplusplus | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment