From 85ffe8dcdc2fe39e06037e382e012674ee051e1e Mon Sep 17 00:00:00 2001 From: Nikita Popov Date: Thu, 18 Feb 2021 10:29:19 +0100 Subject: Avoid signed integer overflow in substr() Perform negation after the (size_t) cast rather than before, so as to avoid a signed integer overflow for PHP_INT_MIN. Fixes oss-fuzz #31069. --- ext/standard/string.c | 4 ++-- ext/standard/tests/strings/substr_int_min.phpt | 10 ++++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) create mode 100644 ext/standard/tests/strings/substr_int_min.phpt (limited to 'ext/standard') diff --git a/ext/standard/string.c b/ext/standard/string.c index 8d0754347a..cf77435f80 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -2177,7 +2177,7 @@ PHP_FUNCTION(substr) /* if "from" position is negative, count start position from the end * of the string */ - if ((size_t)-f > ZSTR_LEN(str)) { + if (-(size_t)f > ZSTR_LEN(str)) { f = 0; } else { f = (zend_long)ZSTR_LEN(str) + f; @@ -2191,7 +2191,7 @@ PHP_FUNCTION(substr) /* if "length" position is negative, set it to the length * needed to stop that many chars from the end of the string */ - if ((size_t)(-l) > ZSTR_LEN(str) - (size_t)f) { + if (-(size_t)l > ZSTR_LEN(str) - (size_t)f) { l = 0; } else { l = (zend_long)ZSTR_LEN(str) - f + l; diff --git a/ext/standard/tests/strings/substr_int_min.phpt b/ext/standard/tests/strings/substr_int_min.phpt new file mode 100644 index 0000000000..4c00577e28 --- /dev/null +++ b/ext/standard/tests/strings/substr_int_min.phpt @@ -0,0 +1,10 @@ +--TEST-- +substr() with PHP_INT_MIN offset or length +--FILE-- + +--EXPECT-- +string(1) "x" +string(0) "" -- cgit v1.2.1