diff options
| author | Stanislav Malyshev <stas@php.net> | 2015-03-17 17:07:38 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2015-03-17 17:10:05 -0700 |
| commit | bf2f03ddb3be0fb54dfbe0234dc56ef37bcb01c3 (patch) | |
| tree | cb897eff74f5e2f56049c0a9f16323fa811a124e | |
| parent | 6264f81a21f7f107f948a299d97081f7dfe0871e (diff) | |
| parent | fb04dcf6dbb48aecd8d2dc986806cb58c8ae5282 (diff) | |
| download | php-git-bf2f03ddb3be0fb54dfbe0234dc56ef37bcb01c3.tar.gz | |
Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
Fix bug #69248 - heap overflow vulnerability in regcomp.c
add test for bug #68976
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/ereg/regex/regcomp.c | 10 | ||||
| -rw-r--r-- | ext/standard/tests/serialize/bug68976.phpt | 37 |
3 files changed, 49 insertions, 1 deletions
@@ -21,6 +21,9 @@ PHP NEWS . Fixed bug #65406 (Enchant broker plugins are in the wrong place in windows builds). (Anatol) +- Ereg: + . Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (Stas) + - Filter: . Fixed bug #69202 (FILTER_FLAG_STRIP_BACKTICK ignored unless other flags are used). (Jeff Welch) diff --git a/ext/ereg/regex/regcomp.c b/ext/ereg/regex/regcomp.c index 156eee9329..f4bfc1c167 100644 --- a/ext/ereg/regex/regcomp.c +++ b/ext/ereg/regex/regcomp.c @@ -117,7 +117,15 @@ int cflags; (NC-1)*sizeof(cat_t)); if (g == NULL) return(REG_ESPACE); - p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */ + { + /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */ + size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */ + if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) { + free((char *) g); + return REG_INVARG; + } + p->ssize = new_ssize; + } p->strip = (sop *)malloc(p->ssize * sizeof(sop)); p->slen = 0; if (p->strip == NULL) { diff --git a/ext/standard/tests/serialize/bug68976.phpt b/ext/standard/tests/serialize/bug68976.phpt new file mode 100644 index 0000000000..a79a953a4a --- /dev/null +++ b/ext/standard/tests/serialize/bug68976.phpt @@ -0,0 +1,37 @@ +--TEST-- +Bug #68976 Use After Free Vulnerability in unserialize() +--FILE-- +<?php +class evilClass { + public $name; + function __wakeup() { + unset($this->name); + } +} + +$fakezval = pack( + 'IIII', + 0x00100000, + 0x00000400, + 0x00000000, + 0x00000006 +); + +$data = unserialize('a:2:{i:0;O:9:"evilClass":1:{s:4:"name";a:2:{i:0;i:1;i:1;i:2;}}i:1;R:4;}'); + +for($i = 0; $i < 5; $i++) { + $v[$i] = $fakezval.$i; +} + +var_dump($data); +?> +===DONE=== +--EXPECTF-- +array(2) { + [0]=> + object(evilClass)#1 (0) { + } + [1]=> + int(1) +} +===DONE=== |