summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStanislav Malyshev <stas@php.net>2018-02-26 22:26:26 -0800
committerStanislav Malyshev <stas@php.net>2018-02-26 22:26:26 -0800
commitdde7a05978ba3aad2192f78c73d331bfb56059c9 (patch)
tree8bdc8c147b001351eee704f6333616fd370ec79d
parent09a19e778b2a16592a71762fdfe55a781045f590 (diff)
parent523f230c831d7b33353203fa34aee4e92ac12bba (diff)
downloadphp-git-dde7a05978ba3aad2192f78c73d331bfb56059c9.tar.gz
Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6: Fix bug #75981: prevent reading beyond buffer start
-rw-r--r--ext/standard/http_fopen_wrapper.c4
-rw-r--r--ext/standard/tests/http/bug75981.phpt32
2 files changed, 34 insertions, 2 deletions
diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c
index e60ac225c9..ab10ed11b6 100644
--- a/ext/standard/http_fopen_wrapper.c
+++ b/ext/standard/http_fopen_wrapper.c
@@ -734,9 +734,9 @@ finish:
tmp_line, response_code);
}
}
- if (tmp_line[tmp_line_len - 1] == '\n') {
+ if (tmp_line_len >= 1 && tmp_line[tmp_line_len - 1] == '\n') {
--tmp_line_len;
- if (tmp_line[tmp_line_len - 1] == '\r') {
+ if (tmp_line_len >= 1 &&tmp_line[tmp_line_len - 1] == '\r') {
--tmp_line_len;
}
}
diff --git a/ext/standard/tests/http/bug75981.phpt b/ext/standard/tests/http/bug75981.phpt
new file mode 100644
index 0000000000..d415de66b9
--- /dev/null
+++ b/ext/standard/tests/http/bug75981.phpt
@@ -0,0 +1,32 @@
+--TEST--
+Bug #75981 (stack-buffer-overflow while parsing HTTP response)
+--INI--
+allow_url_fopen=1
+--SKIPIF--
+<?php require 'server.inc'; http_server_skipif('tcp://127.0.0.1:12342'); ?>
+--FILE--
+<?php
+require 'server.inc';
+
+$options = [
+ 'http' => [
+ 'protocol_version' => '1.1',
+ 'header' => 'Connection: Close'
+ ],
+];
+
+$ctx = stream_context_create($options);
+
+$responses = [
+ "data://text/plain,000000000100\xA\xA"
+];
+$pid = http_server('tcp://127.0.0.1:12342', $responses);
+
+echo @file_get_contents('http://127.0.0.1:12342/', false, $ctx);
+
+http_server_kill($pid);
+
+?>
+DONE
+--EXPECT--
+DONE