diff options
| author | Felipe Pena <felipe@php.net> | 2011-03-08 13:11:14 +0000 |
|---|---|---|
| committer | Felipe Pena <felipe@php.net> | 2011-03-08 13:11:14 +0000 |
| commit | 4fcffb544368dabaea568df4450e217a1e2200a4 (patch) | |
| tree | af140d1636b07d55d9388550de84b8c4c261a9b8 /ext/shmop | |
| parent | a37cf682d86458d85c23bbfe0daa5e1de2b7663f (diff) | |
| download | php-git-4fcffb544368dabaea568df4450e217a1e2200a4.tar.gz | |
- Fixed bug #54193 (Integer overflow in shmop_read())
Diffstat (limited to 'ext/shmop')
| -rw-r--r-- | ext/shmop/shmop.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ext/shmop/shmop.c b/ext/shmop/shmop.c index 1843b21143..31c7879e64 100644 --- a/ext/shmop/shmop.c +++ b/ext/shmop/shmop.c @@ -256,7 +256,7 @@ PHP_FUNCTION(shmop_read) RETURN_FALSE; } - if (start + count > shmop->size || count < 0) { + if (count < 0 || start > (INT_MAX - count) || start + count > shmop->size) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "count is out of range"); RETURN_FALSE; } |