diff options
| author | Stanislav Malyshev <stas@php.net> | 2019-01-06 12:50:10 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2019-01-06 12:50:10 -0800 |
| commit | 0f148839b5944df8f36624df53aa8d7199718f19 (patch) | |
| tree | 83544948712a768192d7f809c7683ecf48a4efe9 /ext/mbstring/php_mbregex.c | |
| parent | 3d9624e126366fe924f1374206e29c88a75c9361 (diff) | |
| parent | e617f03066ce81d26f56c06d6bd7787c7de08703 (diff) | |
| download | php-git-0f148839b5944df8f36624df53aa8d7199718f19.tar.gz | |
Merge branch 'PHP-7.3'
* PHP-7.3:
Fix #77367: Negative size parameter in mb_split
Fix #77369 - memcpy with negative length via crafted DNS response
Fix more issues with encodilng length
Fix #77270: imagecolormatch Out Of Bounds Write on Heap
Fix bug #77380 (Global out of bounds read in xmlrpc base64 code)
Fix bug #77371 (heap buffer overflow in mb regex functions - compile_string_node)
Fix bug #77370 - check that we do not read past buffer end when parsing multibytes
Fix #77269: Potential unsigned underflow in gdImageScale
Fix bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext)
Fix bug #77242 (heap out of bounds read in xmlrpc_decode())
Regenerate certs for openssl tests
Diffstat (limited to 'ext/mbstring/php_mbregex.c')
| -rw-r--r-- | ext/mbstring/php_mbregex.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c index 68922b6966..85219b00e4 100644 --- a/ext/mbstring/php_mbregex.c +++ b/ext/mbstring/php_mbregex.c @@ -1238,7 +1238,6 @@ PHP_FUNCTION(mb_split) size_t string_len; int err; - size_t n; zend_long count = -1; if (zend_parse_parameters(ZEND_NUM_ARGS(), "ss|l", &arg_pattern, &arg_pattern_len, &string, &string_len, &count) == FAILURE) { @@ -1296,8 +1295,8 @@ PHP_FUNCTION(mb_split) } /* otherwise we just have one last element to add to the array */ - n = ((OnigUChar *)(string + string_len) - chunk_pos); - if (n > 0) { + if ((OnigUChar *)(string + string_len) > chunk_pos) { + size_t n = ((OnigUChar *)(string + string_len) - chunk_pos); add_next_index_stringl(return_value, (char *)chunk_pos, n); } else { add_next_index_stringl(return_value, "", 0); |