Skip to content

Commit 0ba04f7

Browse files
committed
Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0: Improve fix for #74145 Fix wddx Fix tests Fixed bug #74111 Fix bug #74603 - use correct buffer size Fix bug #74651 - check EVP_SealInit as it can return -1 Update NEWS Fix bug #74087 Fixed parsing of strange formats with mixed month/day and time strings Fix bug #74145 - wddx parsing empty boolean tag leads to SIGSEGV Fixed bug #74111 Fix #74435: Buffer over-read into uninitialized memory Fix bug #74603 - use correct buffer size Fix bug #74651 - check EVP_SealInit as it can return -1 Update NEWS Fix bug #73807
2 parents 1fa8e74 + 54840f9 commit 0ba04f7

22 files changed

+6486
-7294
lines changed

Zend/tests/bug74603.ini

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
0=0&~2000000000

Zend/tests/bug74603.phpt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
Bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability)
3+
--SKIPIF--
4+
<?php
5+
if (PHP_INT_MAX !== 2147483647)
6+
die('skip for 32-bit only');
7+
--FILE--
8+
<?php
9+
var_dump(parse_ini_file(__DIR__ . "/bug74603.ini", true, INI_SCANNER_NORMAL));
10+
?>
11+
--EXPECT--
12+
array(1) {
13+
[0]=>
14+
string(1) "0"
15+
}

Zend/zend_ini_parser.y

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
5555
int i_result;
5656
int i_op1, i_op2;
5757
int str_len;
58-
char str_result[MAX_LENGTH_OF_LONG];
58+
char str_result[MAX_LENGTH_OF_LONG+1];
5959

6060
i_op1 = atoi(Z_STRVAL_P(op1));
6161
zend_string_free(Z_STR_P(op1));

0 commit comments

Comments
 (0)