diff options
| author | Gustavo André dos Santos Lopes <cataphract@php.net> | 2011-02-21 06:53:24 +0000 |
|---|---|---|
| committer | Gustavo André dos Santos Lopes <cataphract@php.net> | 2011-02-21 06:53:24 +0000 |
| commit | 2a6968e43ae4dc6b91c44f59daa94b3a2b26fd51 (patch) | |
| tree | 1e78200fc3e0fc0d32e11987fe223a803568166a /main/snprintf.c | |
| parent | b21f62eb2d833bd435a13289a85e29c559ee9d74 (diff) | |
| download | php-git-2a6968e43ae4dc6b91c44f59daa94b3a2b26fd51.tar.gz | |
- Fixed bug #54055 (buffer overrun with high values for precision ini
setting).
#This fix (for g/G/k/H modes) is done at a different level than that for the
#modes e/E/f/F, at a bit higher level and therefore with less coverage. I
#chose this because it addresses the problem where it is -- the calling function
#that passes a buffer too small to php_gcvt.
Diffstat (limited to 'main/snprintf.c')
| -rw-r--r-- | main/snprintf.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/main/snprintf.c b/main/snprintf.c index 0e052baa6a..a1b253cfda 100644 --- a/main/snprintf.c +++ b/main/snprintf.c @@ -677,10 +677,6 @@ static int format_converter(register buffy * odp, const char *fmt, va_list ap) / /* * Check if a precision was specified - * - * XXX: an unreasonable amount of precision may be specified - * resulting in overflow of num_buf. Currently we - * ignore this possibility. */ if (*fmt == '.') { adjust_precision = YES; @@ -694,6 +690,10 @@ static int format_converter(register buffy * odp, const char *fmt, va_list ap) / precision = 0; } else precision = 0; + + if (precision > FORMAT_CONV_MAX_PRECISION) { + precision = FORMAT_CONV_MAX_PRECISION; + } } else adjust_precision = NO; } else |