Search
j0ke.net Open Build Service
>
Projects
>
home:netmax
:
rebuilds
>
php4
> php-4.3.9-CVE-2007-2872.patch
Sign Up
|
Log In
Username
Password
Cancel
Overview
Repositories
Revisions
Requests
Users
Advanced
Attributes
Meta
File php-4.3.9-CVE-2007-2872.patch of Package php4
--- php-4.3.9/ext/standard/string.c.cve2872 +++ php-4.3.9/ext/standard/string.c @@ -1510,11 +1510,25 @@ static PHP_ATTRIBUTE_MALLOC char *php_ch char *p, *q; int chunks; /* complete chunks! */ int restlen; + int out_len; chunks = srclen / chunklen; restlen = srclen - chunks * chunklen; /* srclen % chunklen */ - dest = safe_emalloc(sizeof(char), (srclen + (chunks + 1) * endlen + 1), 0); + if(chunks > INT_MAX - 1) { + return NULL; + } + out_len = chunks + 1; + if(endlen != 0 && out_len > INT_MAX/endlen) { + return NULL; + } + out_len *= endlen; + if(out_len > INT_MAX - srclen - 1) { + return NULL; + } + out_len += srclen + 1; + + dest = safe_emalloc(out_len, sizeof(char), 0); for (p = src, q = dest; p < (src + srclen - chunklen + 1); ) { memcpy(q, p, chunklen);