diff options
author | Stanislav Malyshev <stas@php.net> | 2012-06-07 23:05:23 -0700 |
---|---|---|
committer | Stanislav Malyshev <stas@php.net> | 2012-06-07 23:08:35 -0700 |
commit | 7d04e0fb2ec8be9b1c4b16a9f0b4958f853597f1 (patch) | |
tree | fc5036234c63c2412843a399cf354732fdbbfed5 /main | |
parent | baacc2cb135280f18f6c908b4b99160fba262c6a (diff) | |
download | php-git-7d04e0fb2ec8be9b1c4b16a9f0b4958f853597f1.tar.gz |
fix potential overflow in _php_stream_scandir
Diffstat (limited to 'main')
-rwxr-xr-x | main/streams/streams.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/main/streams/streams.c b/main/streams/streams.c index fe7800b9fe..43cb0104f3 100755 --- a/main/streams/streams.c +++ b/main/streams/streams.c @@ -2262,8 +2262,8 @@ PHPAPI int _php_stream_scandir(char *dirname, char **namelist[], int flags, php_ php_stream *stream; php_stream_dirent sdp; char **vector = NULL; - int vector_size = 0; - int nfiles = 0; + unsigned int vector_size = 0; + unsigned int nfiles = 0; if (!namelist) { return FAILURE; @@ -2281,12 +2281,17 @@ PHPAPI int _php_stream_scandir(char *dirname, char **namelist[], int flags, php_ } else { vector_size *= 2; } - vector = (char **) erealloc(vector, vector_size * sizeof(char *)); + vector = (char **) safe_erealloc(vector, vector_size, sizeof(char *), 0); } vector[nfiles] = estrdup(sdp.d_name); nfiles++; + if(vector_size < 10 || nfiles == 0) { + /* overflow */ + efree(vector); + return FAILURE; + } } php_stream_closedir(stream); |