diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2018-06-28 23:04:54 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2018-06-28 23:05:09 +0200 |
| commit | 00c0d7702ce92ed132ad7234ca63bdec28e56421 (patch) | |
| tree | 7a1d5d3e16a06f945531409ee6a22aff4fcf2a66 | |
| parent | c5276ad3808f0b97288394d6b0a552471a6e0bf6 (diff) | |
| parent | bf5a802f5a87010cee94df1cda2918f3be8ae96e (diff) | |
| download | php-git-00c0d7702ce92ed132ad7234ca63bdec28e56421.tar.gz | |
Merge branch 'PHP-7.1' into PHP-7.2
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | ext/mbstring/libmbfl/mbfl/mbfilter.c | 2 | ||||
| -rw-r--r-- | ext/mbstring/libmbfl/mbfl/mbfilter.h | 7 | ||||
| -rw-r--r-- | ext/mbstring/tests/bug76532.phpt | 12 |
4 files changed, 24 insertions, 1 deletions
@@ -20,6 +20,10 @@ PHP NEWS . Fixed bug #73342 (Vulnerability in php-fpm by changing stdin to non-blocking). (Nikita) +- mbstring: + . Fixed bug #76532 (Integer overflow and excessive memory usage + in mb_strimwidth). (MarcusSchwarz) + - Opcache: . Fixed bug #76477 (Opcache causes empty return value). (Nikita, Laruence) diff --git a/ext/mbstring/libmbfl/mbfl/mbfilter.c b/ext/mbstring/libmbfl/mbfl/mbfilter.c index 4986472b9b..35ca9d3b9c 100644 --- a/ext/mbstring/libmbfl/mbfl/mbfilter.c +++ b/ext/mbstring/libmbfl/mbfl/mbfilter.c @@ -1875,7 +1875,7 @@ mbfl_strimwidth( mbfl_string_init(result); result->no_language = string->no_language; result->no_encoding = string->no_encoding; - mbfl_memory_device_init(&pc.device, width, 0); + mbfl_memory_device_init(&pc.device, MIN(string->len, width), 0); /* output code filter */ pc.decoder = mbfl_convert_filter_new( diff --git a/ext/mbstring/libmbfl/mbfl/mbfilter.h b/ext/mbstring/libmbfl/mbfl/mbfilter.h index 565ed3252d..215e07d1d6 100644 --- a/ext/mbstring/libmbfl/mbfl/mbfilter.h +++ b/ext/mbstring/libmbfl/mbfl/mbfilter.h @@ -114,6 +114,13 @@ #define MBFL_OUTPUTFILTER_ILLEGAL_MODE_ENTITY 3 /* + * convenience macros + */ +#ifndef MIN +#define MIN(a,b) ((a)<(b)?(a):(b)) +#endif + +/* * buffering converter */ typedef struct _mbfl_buffer_converter mbfl_buffer_converter; diff --git a/ext/mbstring/tests/bug76532.phpt b/ext/mbstring/tests/bug76532.phpt new file mode 100644 index 0000000000..e61e403dbf --- /dev/null +++ b/ext/mbstring/tests/bug76532.phpt @@ -0,0 +1,12 @@ +--TEST-- +Bug #76532 (Integer overflow and excessive memory usage in mb_strimwidth) +--SKIPIF-- +<?php require 'skipif.inc'; ?> +--FILE-- +<?php +$string_to_trim = '得很幸福。有一天，一个长得很丑的老人带着一只木马来到王'; +$width = 2147483647; +var_dump(mb_strimwidth($string_to_trim, 0, $width)); +?> +--EXPECT-- +string(81) "得很幸福。有一天，一个长得很丑的老人带着一只木马来到王"
\ No newline at end of file |