Skip to content

Commit 5f8380d

Browse files
committed
Fix bug #74603 - use correct buffer size
1 parent 89637c6 commit 5f8380d

File tree

3 files changed

+17
-1
lines changed

3 files changed

+17
-1
lines changed

Zend/tests/bug74603.ini

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
0=0&~2000000000

Zend/tests/bug74603.phpt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
Bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability)
3+
--SKIPIF--
4+
<?php
5+
if (PHP_INT_MAX !== 2147483647)
6+
die('skip for 32-bit only');
7+
--FILE--
8+
<?php
9+
var_dump(parse_ini_file(__DIR__ . "/bug74603.ini", true, INI_SCANNER_NORMAL));
10+
?>
11+
--EXPECT--
12+
array(1) {
13+
[0]=>
14+
string(1) "0"
15+
}

Zend/zend_ini_parser.y

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
5353
{
5454
int i_result;
5555
int i_op1, i_op2;
56-
char str_result[MAX_LENGTH_OF_LONG];
56+
char str_result[MAX_LENGTH_OF_LONG+1];
5757

5858
i_op1 = atoi(Z_STRVAL_P(op1));
5959
free(Z_STRVAL_P(op1));

0 commit comments

Comments
 (0)