diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2006-12-31 22:25:55 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2006-12-31 22:25:55 +0000 |
| commit | ba645539131468b9c5fdc47762f4a4bc744bfbf5 (patch) | |
| tree | 1e841f457b5f59813c2b366ee4d9b9852f93bcf9 | |
| parent | 96489b417845c5ee2e36f42142c97286bd28afbd (diff) | |
| download | php-git-ba645539131468b9c5fdc47762f4a4bc744bfbf5.tar.gz | |
Added boundary checks to php_binary deserializer
| -rw-r--r-- | ext/session/session.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/ext/session/session.c b/ext/session/session.c index 3fbb5151a7..db2e24a72a 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -471,6 +471,11 @@ PS_SERIALIZER_DECODE_FUNC(php_binary) for (p = val; p < endptr; ) { zval **tmp; namelen = *p & (~PS_BIN_UNDEF); + + if (namelen > PS_BIN_MAX || (p + namelen) >= endptr) { + return FAILURE; + } + has_value = *p & PS_BIN_UNDEF ? 0 : 1; name = estrndup(p + 1, namelen); |