summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPierre Joye <pajoye@php.net>2010-04-28 14:10:01 +0000
committerPierre Joye <pajoye@php.net>2010-04-28 14:10:01 +0000
commit68e0e88610aa5021aaaaabd7a76464cb92d0ec51 (patch)
treee90030a6489a916eaf2a34876d289ef1ca6885ae
parent16d5d5966e79eeef67e29ce0c8a75cefeef5ef95 (diff)
downloadphp-git-68e0e88610aa5021aaaaabd7a76464cb92d0ec51.tar.gz
- fix possible Dechunking Filter Buffer Overflow
-rw-r--r--ext/standard/filters.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/ext/standard/filters.c b/ext/standard/filters.c
index 9fa3a17199..ae7e03022f 100644
--- a/ext/standard/filters.c
+++ b/ext/standard/filters.c
@@ -1914,7 +1914,7 @@ typedef enum _php_chunked_filter_state {
typedef struct _php_chunked_filter_data {
php_chunked_filter_state state;
- int chunk_size;
+ size_t chunk_size;
int persistent;
} php_chunked_filter_data;
@@ -1991,7 +1991,7 @@ static int php_dechunk(char *buf, int len, php_chunked_filter_data *data)
continue;
}
case CHUNK_BODY:
- if (end - p >= data->chunk_size) {
+ if ((size_t) (end - p) >= data->chunk_size) {
if (p != out) {
memmove(out, p, data->chunk_size);
}