diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2004-12-23 18:29:36 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2004-12-23 18:29:36 +0000 |
| commit | 8a03620e1aed288305d1e3f04a9eb05787a32a6e (patch) | |
| tree | 7f7d047fe6ce158ebe973bccfa38a4b83a189e7c | |
| parent | c75458bac3672b4672e1cca8049a5c2c00f0170d (diff) | |
| download | php-git-8a03620e1aed288305d1e3f04a9eb05787a32a6e.tar.gz | |
Fixed potential buffer overflow inside swf_definepoly().
| -rw-r--r-- | ext/swf/swf.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/ext/swf/swf.c b/ext/swf/swf.c index e314ccf77e..afc9099cf1 100644 --- a/ext/swf/swf.c +++ b/ext/swf/swf.c @@ -611,8 +611,13 @@ PHP_FUNCTION(swf_definepoly) convert_to_double_ex(width); if (Z_TYPE_PP(coordinates) != IS_ARRAY) { - return; php_error(E_WARNING, "Wrong datatype of second argument to swf_definepoly"); + RETURN_FALSE; + } + + if (Z_LVAL_PP(NumPoints) > 256) { + php_error(E_WARNING, "The npoints value cannot be larger then 256."); + RETURN_FALSE; } npoints = Z_LVAL_PP(NumPoints); |