Skip to content

Commit d71a0dc

Browse files
cmb69cmb69
committed
Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4: Fix #73122: Integer Overflow when concatenating strings
2 parents 3454ea3 + 0b7dffb commit d71a0dc

File tree

3 files changed

+28
-0
lines changed

3 files changed

+28
-0
lines changed

‎NEWS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ PHP NEWS
66
. Fixed bug #81302 (Stream position after stream filter removed). (cmb)
77
. Fixed bug #81346 (Non-seekable streams don't update position after write).
88
(cmb)
9+
. Fixed bug #73122 (Integer Overflow when concatenating strings). (cmb)
910

1011
- Opcache:
1112
. Fixed bug #81353 (segfault with preloading and statically bound closure).

‎Zend/zend_vm_def.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -407,6 +407,9 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TMPVAR|CV, CONST|TMPVAR|CV, SPEC(NO_CONST_
407407
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
408408
size_t len = ZSTR_LEN(op1_str);
409409

410+
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
411+
zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
412+
}
410413
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
411414
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
412415
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);

‎Zend/zend_vm_execute.h

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8179,6 +8179,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_TMPVAR_HANDL
81798179
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
81808180
size_t len = ZSTR_LEN(op1_str);
81818181

8182+
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
8183+
zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
8184+
}
81828185
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
81838186
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
81848187
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
@@ -10562,6 +10565,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CV_HANDLER(Z
1056210565
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
1056310566
size_t len = ZSTR_LEN(op1_str);
1056410567

10568+
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
10569+
zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
10570+
}
1056510571
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
1056610572
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
1056710573
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
@@ -14625,6 +14631,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CONST_HANDL
1462514631
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
1462614632
size_t len = ZSTR_LEN(op1_str);
1462714633

14634+
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
14635+
zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
14636+
}
1462814637
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
1462914638
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
1463014639
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
@@ -16045,6 +16054,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_TMPVAR_HAND
1604516054
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
1604616055
size_t len = ZSTR_LEN(op1_str);
1604716056

16057+
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
16058+
zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
16059+
}
1604816060
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
1604916061
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
1605016062
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
@@ -17717,6 +17729,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER(
1771717729
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
1771817730
size_t len = ZSTR_LEN(op1_str);
1771917731

17732+
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
17733+
zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
17734+
}
1772017735
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
1772117736
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
1772217737
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
@@ -38633,6 +38648,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CONST_HANDLER(Z
3863338648
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
3863438649
size_t len = ZSTR_LEN(op1_str);
3863538650

38651+
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
38652+
zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
38653+
}
3863638654
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
3863738655
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
3863838656
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
@@ -42247,6 +42265,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_TMPVAR_HANDLER(
4224742265
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
4224842266
size_t len = ZSTR_LEN(op1_str);
4224942267

42268+
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
42269+
zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
42270+
}
4225042271
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
4225142272
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
4225242273
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
@@ -47225,6 +47246,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND
4722547246
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
4722647247
size_t len = ZSTR_LEN(op1_str);
4722747248

47249+
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
47250+
zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
47251+
}
4722847252
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
4722947253
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
4723047254
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);

0 commit comments

Comments
 (0)