From 9164dc11e2323b8b80c389bb13d70789799b44fc Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Tue, 16 Aug 2016 20:36:33 +0200 Subject: Fix #72714: _xml_startElementHandler() segmentation fault The issue is caused by an integer overflow when the `long` passed as XML_OPTION_SKIP_TAGSTART is assigned to `xml_parser::toffset` which is declared as `int`. We can simply work around this issue, by clipping resulting negative values to 0 (and raising a notice in this case), because the reasonable range for this value is certainly catered to by positive `int`s. However, there still remains the issue that `xml_parser::toffset` is later added to `char *`s, which can cause OOB reads, so we make sure that the upper bound never exceeds the strlen(). We eschew optimizing `SKIP_TAGSTART` wrt. to the potentially duplicate strlen() call, because that code path is unexpected anyway. --- NEWS | 1 + 1 file changed, 1 insertion(+) (limited to 'NEWS') diff --git a/NEWS b/NEWS index d74cc191a2..013d85f84b 100644 --- a/NEWS +++ b/NEWS @@ -36,6 +36,7 @@ PHP NEWS - XML: . Fixed bug #72085 (SEGV on unknown address zif_xml_parse). (cmb) + . Fixed bug #72714 (_xml_startElementHandler() segmentation fault). (cmb) - ZIP: . Fixed bug #68302 (impossible to compile php with zip support). (cmb) -- cgit v1.2.1