Merge branch 'PHP-7.4' into PHP-8.0

cmb69 · cmb69 · commit c0a1ef3e3268 · 2021-07-15T12:56:12.000+02:00
* PHP-7.4:
  Fix #72146: Integer overflow on substr_replace
diff --git a/NEWS b/NEWS
@@ -2,6 +2,8 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2021, PHP 8.0.10
 
+- Standard:
+  . Fixed bug #72146 (Integer overflow on substr_replace). (cmb)
 
 29 Jul 2021, PHP 8.0.9
 
diff --git a/ext/standard/string.c b/ext/standard/string.c
@@ -2395,7 +2395,9 @@ PHP_FUNCTION(substr_replace)
 				}
 			}
 
-			if ((f + l) > (zend_long)ZSTR_LEN(orig_str)) {
+			ZEND_ASSERT(0 <= f && f <= ZEND_LONG_MAX);
+			ZEND_ASSERT(0 <= l && l <= ZEND_LONG_MAX);
+			if (((size_t) f + l) > ZSTR_LEN(orig_str)) {
 				l = ZSTR_LEN(orig_str) - f;
 			}
 
diff --git a/ext/standard/tests/strings/bug72146.phpt b/ext/standard/tests/strings/bug72146.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #72146 (Integer overflow on substr_replace)
+--FILE--
+<?php 
+var_dump(substr_replace(["ABCDE"], "123", 3, PHP_INT_MAX));
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(6) "ABC123"
+}

Original file line number	Diff line number	Diff line change
`@@ -2395,7 +2395,9 @@ PHP_FUNCTION(substr_replace)`
`2395`	`2395`	`}`
`2396`	`2396`	`}`
`2397`	`2397`
`2398`		`- if ((f + l) > (zend_long)ZSTR_LEN(orig_str)) {`
	`2398`	`+ ZEND_ASSERT(0 <= f && f <= ZEND_LONG_MAX);`
	`2399`	`+ ZEND_ASSERT(0 <= l && l <= ZEND_LONG_MAX);`
	`2400`	`+ if (((size_t) f + l) > ZSTR_LEN(orig_str)) {`
`2399`	`2401`	`l = ZSTR_LEN(orig_str) - f;`
`2400`	`2402`	`}`
`2401`	`2403`