diff options
| author | Stanislav Malyshev <stas@php.net> | 2019-01-01 17:15:20 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2019-01-06 11:34:00 -0800 |
| commit | 1cc2182bcc81e185c14837e659d12b268cb99d63 (patch) | |
| tree | 749dd52dc16e9e29ee58d22db6e5736bad443d74 /ext | |
| parent | 28362ed4fae6969b5a8878591a5a06eadf114e03 (diff) | |
| download | php-git-1cc2182bcc81e185c14837e659d12b268cb99d63.tar.gz | |
Fix bug #77380 (Global out of bounds read in xmlrpc base64 code)
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/xmlrpc/libxmlrpc/base64.c | 4 | ||||
| -rw-r--r-- | ext/xmlrpc/tests/bug77380.phpt | 17 |
2 files changed, 19 insertions, 2 deletions
diff --git a/ext/xmlrpc/libxmlrpc/base64.c b/ext/xmlrpc/libxmlrpc/base64.c index 5ebdf31f7a..a4fa19327b 100644 --- a/ext/xmlrpc/libxmlrpc/base64.c +++ b/ext/xmlrpc/libxmlrpc/base64.c @@ -77,7 +77,7 @@ void base64_encode_xmlrpc(struct buffer_st *b, const char *source, int length) while (!hiteof) { unsigned char igroup[3], ogroup[4]; - int c, n; + int c, n; igroup[0] = igroup[1] = igroup[2] = 0; for (n = 0; n < 3; n++) { @@ -169,7 +169,7 @@ void base64_decode_xmlrpc(struct buffer_st *bfr, const char *source, int length) return; } - if (dtable[c] & 0x80) { + if (dtable[(unsigned char)c] & 0x80) { /* fprintf(stderr, "Offset %i length %i\n", offset, length); fprintf(stderr, "character '%c:%x:%c' in input file.\n", c, c, dtable[c]); diff --git a/ext/xmlrpc/tests/bug77380.phpt b/ext/xmlrpc/tests/bug77380.phpt new file mode 100644 index 0000000000..8559c07a5a --- /dev/null +++ b/ext/xmlrpc/tests/bug77380.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #77380 (Global out of bounds read in xmlrpc base64 code) +--SKIPIF-- +<?php +if (!extension_loaded("xmlrpc")) print "skip"; +?> +--FILE-- +<?php +var_dump(xmlrpc_decode(base64_decode("PGJhc2U2ND7CkzwvYmFzZTY0Pgo="))); +?> +--EXPECT-- +object(stdClass)#1 (2) { + ["scalar"]=> + string(0) "" + ["xmlrpc_type"]=> + string(6) "base64" +} |