diff options
| author | Antony Dovgal <tony2001@php.net> | 2007-05-10 22:10:43 +0000 |
|---|---|---|
| committer | Antony Dovgal <tony2001@php.net> | 2007-05-10 22:10:43 +0000 |
| commit | 8de1ecef64be13c1cde539d8bc5bcaff4b38697f (patch) | |
| tree | 2514d67bd97d01d0bd94797ae439270c3e8d9f13 /ext/standard/string.c | |
| parent | 5d8567b83bc5f9c24f7ab83634ec63842954b4b2 (diff) | |
| download | php-git-8de1ecef64be13c1cde539d8bc5bcaff4b38697f.tar.gz | |
MFH: fix segfault in strripos() when offset == INT_MAX+1
identified and repoted by Joxean Koret
Diffstat (limited to 'ext/standard/string.c')
| -rw-r--r-- | ext/standard/string.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ext/standard/string.c b/ext/standard/string.c index 98daf7ae9c..56981b0778 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -1856,7 +1856,7 @@ PHP_FUNCTION(strripos) e = haystack + haystack_len - 1; } else { p = haystack; - if (-offset > haystack_len) { + if (-offset > haystack_len || -offset < 0) { php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Offset is greater than the length of haystack string"); RETURN_FALSE; } else { @@ -1889,7 +1889,7 @@ PHP_FUNCTION(strripos) p = haystack_dup + offset; e = haystack_dup + haystack_len - needle_len; } else { - if (-offset > haystack_len) { + if (-offset > haystack_len || -offset < 0) { efree(needle_dup); efree(haystack_dup); php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Offset is greater than the length of haystack string"); |