diff options
author | Stanislav Malyshev <stas@php.net> | 2019-05-27 16:49:19 -0700 |
---|---|---|
committer | Stanislav Malyshev <stas@php.net> | 2019-05-27 16:49:19 -0700 |
commit | e77c8e45bab082f32d0a6351b0b4fb8a0c0f3ba2 (patch) | |
tree | e44c0e0188bb0afe74ab718e4186399317ef0a78 /ext/iconv | |
parent | a0c9d0849aa5e53c37f8fd68db80412364e8edaf (diff) | |
parent | 16e037bd46359a31f218ee220ff09f1c3270e489 (diff) | |
download | php-git-e77c8e45bab082f32d0a6351b0b4fb8a0c0f3ba2.tar.gz |
Merge branch 'PHP-7.1' into PHP-7.2
* PHP-7.1:
Update NEWS
Fix bug #78069 - Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow
Fix #77973: Uninitialized read in gdImageCreateFromXbm
Diffstat (limited to 'ext/iconv')
-rw-r--r-- | ext/iconv/iconv.c | 4 | ||||
-rw-r--r-- | ext/iconv/tests/bug78069.data | bin | 0 -> 107 bytes | |||
-rw-r--r-- | ext/iconv/tests/bug78069.phpt | 15 |
3 files changed, 18 insertions, 1 deletions
diff --git a/ext/iconv/iconv.c b/ext/iconv/iconv.c index a92395e25f..781985ce3e 100644 --- a/ext/iconv/iconv.c +++ b/ext/iconv/iconv.c @@ -1664,7 +1664,9 @@ static php_iconv_err_t _php_iconv_mime_decode(smart_str *pretval, const char *st * we can do at this point. */ if (*(p1 + 1) == '=') { ++p1; - --str_left; + if (str_left > 1) { + --str_left; + } } err = _php_iconv_appendl(pretval, encoded_word, (size_t)((p1 + 1) - encoded_word), cd_pl); diff --git a/ext/iconv/tests/bug78069.data b/ext/iconv/tests/bug78069.data Binary files differnew file mode 100644 index 0000000000..ebd5d0bdcf --- /dev/null +++ b/ext/iconv/tests/bug78069.data diff --git a/ext/iconv/tests/bug78069.phpt b/ext/iconv/tests/bug78069.phpt new file mode 100644 index 0000000000..1341a5ef4f --- /dev/null +++ b/ext/iconv/tests/bug78069.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow) +--SKIPIF-- +<?php +if (!extension_loaded('iconv')) die('skip ext/iconv required'); +?> +--FILE-- +<?php +$hdr = iconv_mime_decode_headers(file_get_contents(__DIR__ . "/bug78069.data"),2); +var_dump(count($hdr)); +?> +DONE +--EXPECT-- +int(1) +DONE
\ No newline at end of file |