diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-07-12 22:59:19 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2016-07-12 22:59:19 -0700 |
| commit | 2ca8d85dd4ac6d5f8c046f339f9636e3099b0f08 (patch) | |
| tree | 697e98d02d3c225aa5c69f22f28b4b52e1d3f27e | |
| parent | 8bd8a64db64fd1bd89aa0f10b4214f576e72a8a2 (diff) | |
| download | php-git-2ca8d85dd4ac6d5f8c046f339f9636e3099b0f08.tar.gz | |
Fix bug #72541 - size_t overflow lead to heap corruption
| -rw-r--r-- | ext/curl/interface.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/ext/curl/interface.c b/ext/curl/interface.c index 6a616411ef..7d085de73c 100644 --- a/ext/curl/interface.c +++ b/ext/curl/interface.c @@ -3595,6 +3595,10 @@ PHP_FUNCTION(curl_unescape) RETURN_FALSE; } + if (str_len > INT_MAX) { + RETURN_FALSE; + } + if ((out = curl_easy_unescape(ch->cp, str, str_len, &out_len))) { RETVAL_STRINGL(out, out_len); curl_free(out); |