summaryrefslogtreecommitdiff
path: root/ext/standard/uuencode.c
diff options
context:
space:
mode:
authorDmitry Stogov <dmitry@zend.com>2014-05-18 21:17:31 +0400
committerDmitry Stogov <dmitry@zend.com>2014-05-18 21:17:31 +0400
commitb11a30f5eaeae2aa797ebef8722f4b1d51c72198 (patch)
tree838d425afc9a07f00bd4e66e8df7709827c8c339 /ext/standard/uuencode.c
parent583bb6339b03ac64ab38dee792e4aedeaa7d5f07 (diff)
parent91c475fc0094fb23a8f94408684e0c21e195bf48 (diff)
downloadphp-git-b11a30f5eaeae2aa797ebef8722f4b1d51c72198.tar.gz
Merge branch 'master' into phpng
* master: Support for __debugInfo (Joe Watkins) Optimize ZEND_POW (Rouven Weßling) gcov: tentative fix for broken coverage data after fix for opcache coverage slightly hackish, but works. The idea is that we want to give priority to .gcda files in .libs dirs vs the files in the upper level dir gcov: tentative fix for broken coverage data after fix for opcache coverage slightly hackish, but works. The idea is that we want to give priority to .gcda files in .libs dirs vs the files in the upper level dir Prevent recursion in ZF2 Parameters class adding NEWS block for beta4 5.4.30 next enable email notifications update NEWS update NEWS update NEWS - Updated to version 2014.3 (2014c) fix bug #67253: timelib_meridian_with_check out-of-bounds read Fix bug #67252: convert_uudecode out-of-bounds read Fix bug #67251 - date_parse_from_format out-of-bounds read Fix bug #67250 (iptcparse out-of-bounds read) Conflicts: ext/opcache/zend_persist.c ext/spl/spl_array.c
Diffstat (limited to 'ext/standard/uuencode.c')
-rw-r--r--ext/standard/uuencode.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/ext/standard/uuencode.c b/ext/standard/uuencode.c
index 2a1de6ed46..0689de5636 100644
--- a/ext/standard/uuencode.c
+++ b/ext/standard/uuencode.c
@@ -156,6 +156,9 @@ PHPAPI zend_string *php_uudecode(char *src, int src_len) /* {{{ */
}
while (s < ee) {
+ if(s+4 > e) {
+ goto err;
+ }
*p++ = PHP_UU_DEC(*s) << 2 | PHP_UU_DEC(*(s + 1)) >> 4;
*p++ = PHP_UU_DEC(*(s + 1)) << 4 | PHP_UU_DEC(*(s + 2)) >> 2;
*p++ = PHP_UU_DEC(*(s + 2)) << 6 | PHP_UU_DEC(*(s + 3));