diff options
| author | Jakub Zelenka <bukka@php.net> | 2016-08-14 14:00:35 +0100 |
|---|---|---|
| committer | Jakub Zelenka <bukka@php.net> | 2016-08-14 14:00:35 +0100 |
| commit | 436d50a82192cbef4431fe9a70c641f49aec55a8 (patch) | |
| tree | e2cef22ee7d7b463398498cfa3234e3d8807ed1c /ext/json | |
| parent | 98787d90020c7b21c1dd5d1701e6157993d02aec (diff) | |
| parent | 9f1d962ed6057a3996f1b5aa82467a3172e41e8f (diff) | |
| download | php-git-436d50a82192cbef4431fe9a70c641f49aec55a8.tar.gz | |
Merge branch 'PHP-5.6' into PHP-7.0
Diffstat (limited to 'ext/json')
| -rw-r--r-- | ext/json/json.c | 10 | ||||
| -rw-r--r-- | ext/json/tests/bug72787.phpt | 15 |
2 files changed, 25 insertions, 0 deletions
diff --git a/ext/json/json.c b/ext/json/json.c index 6571bf99f0..61445ee114 100644 --- a/ext/json/json.c +++ b/ext/json/json.c @@ -260,6 +260,16 @@ static PHP_FUNCTION(json_decode) RETURN_NULL(); } + if (depth <= 0) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Depth must be greater than zero"); + RETURN_NULL(); + } + + if (depth > INT_MAX) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Depth must be lower than %d", INT_MAX); + RETURN_NULL(); + } + /* For BC reasons, the bool $assoc overrides the long $options bit for PHP_JSON_OBJECT_AS_ARRAY */ if (assoc) { options |= PHP_JSON_OBJECT_AS_ARRAY; diff --git a/ext/json/tests/bug72787.phpt b/ext/json/tests/bug72787.phpt new file mode 100644 index 0000000000..c9820faa9f --- /dev/null +++ b/ext/json/tests/bug72787.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #72787 (json_decode reads out of bounds) +--SKIPIF-- +<?php if (!extension_loaded("json")) print "skip"; ?> +<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); ?> +--FILE-- +<?php + +var_dump(json_decode('[]', false, 0x100000000)); + +?> +--EXPECTF-- + +Warning: json_decode(): Depth must be lower than %d in %s on line %d +NULL |