diff options
author | Pierre Joye <pajoye@php.net> | 2010-04-28 14:10:01 +0000 |
---|---|---|
committer | Pierre Joye <pajoye@php.net> | 2010-04-28 14:10:01 +0000 |
commit | 68e0e88610aa5021aaaaabd7a76464cb92d0ec51 (patch) | |
tree | e90030a6489a916eaf2a34876d289ef1ca6885ae | |
parent | 16d5d5966e79eeef67e29ce0c8a75cefeef5ef95 (diff) | |
download | php-git-68e0e88610aa5021aaaaabd7a76464cb92d0ec51.tar.gz |
- fix possible Dechunking Filter Buffer Overflow
-rw-r--r-- | ext/standard/filters.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ext/standard/filters.c b/ext/standard/filters.c index 9fa3a17199..ae7e03022f 100644 --- a/ext/standard/filters.c +++ b/ext/standard/filters.c @@ -1914,7 +1914,7 @@ typedef enum _php_chunked_filter_state { typedef struct _php_chunked_filter_data { php_chunked_filter_state state; - int chunk_size; + size_t chunk_size; int persistent; } php_chunked_filter_data; @@ -1991,7 +1991,7 @@ static int php_dechunk(char *buf, int len, php_chunked_filter_data *data) continue; } case CHUNK_BODY: - if (end - p >= data->chunk_size) { + if ((size_t) (end - p) >= data->chunk_size) { if (p != out) { memmove(out, p, data->chunk_size); } |