diff options
| author | Jakub Zelenka <bukka@php.net> | 2016-08-14 14:01:36 +0100 |
|---|---|---|
| committer | Jakub Zelenka <bukka@php.net> | 2016-08-14 14:01:36 +0100 |
| commit | 37c12f8f867ad96e005cefc545093e43b633728c (patch) | |
| tree | 445dea292a1831dcc148d64f2d13731affe33cd0 /ext/json | |
| parent | 6ab9b531bc12ba3e746be6615f4edcc1cc387e61 (diff) | |
| parent | 436d50a82192cbef4431fe9a70c641f49aec55a8 (diff) | |
| download | php-git-37c12f8f867ad96e005cefc545093e43b633728c.tar.gz | |
Merge branch 'PHP-7.0' into PHP-7.1
Diffstat (limited to 'ext/json')
| -rw-r--r-- | ext/json/json.c | 10 | ||||
| -rw-r--r-- | ext/json/tests/bug72787.phpt | 15 |
2 files changed, 25 insertions, 0 deletions
diff --git a/ext/json/json.c b/ext/json/json.c index e8b111b28c..2acfb5e79f 100644 --- a/ext/json/json.c +++ b/ext/json/json.c @@ -258,6 +258,16 @@ static PHP_FUNCTION(json_decode) RETURN_NULL(); } + if (depth <= 0) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Depth must be greater than zero"); + RETURN_NULL(); + } + + if (depth > INT_MAX) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Depth must be lower than %d", INT_MAX); + RETURN_NULL(); + } + /* For BC reasons, the bool $assoc overrides the long $options bit for PHP_JSON_OBJECT_AS_ARRAY */ if (assoc) { options |= PHP_JSON_OBJECT_AS_ARRAY; diff --git a/ext/json/tests/bug72787.phpt b/ext/json/tests/bug72787.phpt new file mode 100644 index 0000000000..c9820faa9f --- /dev/null +++ b/ext/json/tests/bug72787.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #72787 (json_decode reads out of bounds) +--SKIPIF-- +<?php if (!extension_loaded("json")) print "skip"; ?> +<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); ?> +--FILE-- +<?php + +var_dump(json_decode('[]', false, 0x100000000)); + +?> +--EXPECTF-- + +Warning: json_decode(): Depth must be lower than %d in %s on line %d +NULL |