From 40e7baab3c90001beee4c8f0ed0ef79ad18ee0d6 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Mon, 3 Oct 2016 00:09:02 -0700 Subject: Fix bug #73190: memcpy negative parameter _bc_new_num_ex --- ext/bcmath/libbcmath/src/init.c | 5 ++++- ext/bcmath/libbcmath/src/outofmem.c | 3 +-- 2 files changed, 5 insertions(+), 3 deletions(-) (limited to 'ext/bcmath/libbcmath/src') diff --git a/ext/bcmath/libbcmath/src/init.c b/ext/bcmath/libbcmath/src/init.c index 986ad1df24..c51133be73 100644 --- a/ext/bcmath/libbcmath/src/init.c +++ b/ext/bcmath/libbcmath/src/init.c @@ -49,7 +49,10 @@ _bc_new_num_ex (length, scale, persistent) int length, scale, persistent; { bc_num temp; - + /* PHP Change: add length check */ + if ((size_t)length+(size_t)scale > INT_MAX) { + zend_error(E_ERROR, "Result too long, max is %d", INT_MAX); + } /* PHP Change: malloc() -> pemalloc(), removed free_list code */ temp = (bc_num) safe_pemalloc (1, sizeof(bc_struct)+length, scale, persistent); #if 0 diff --git a/ext/bcmath/libbcmath/src/outofmem.c b/ext/bcmath/libbcmath/src/outofmem.c index 799a32d2ae..05fa484e11 100644 --- a/ext/bcmath/libbcmath/src/outofmem.c +++ b/ext/bcmath/libbcmath/src/outofmem.c @@ -41,6 +41,5 @@ void bc_out_of_memory (void) { - (void) fprintf (stderr, "bcmath: out of memory!\n"); - exit (1); + zend_error_noreturn(E_ERROR, "bcmath: out of memory!"); } -- cgit v1.2.1