From ccc12efa32f855e6057cb9b7e1e45afe08503a00 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Tue, 19 Apr 2016 23:49:22 -0700 Subject: Fix bug #71923 - integer overflow in ZipArchive::getFrom* --- ext/zip/php_zip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'ext/zip/php_zip.c') diff --git a/ext/zip/php_zip.c b/ext/zip/php_zip.c index db201af634..7c9adf4af7 100644 --- a/ext/zip/php_zip.c +++ b/ext/zip/php_zip.c @@ -1281,7 +1281,7 @@ static PHP_NAMED_FUNCTION(zif_zip_entry_read) } if (zr_rsrc->zf) { - buffer = zend_string_alloc(len, 0); + buffer = zend_string_safe_alloc(1, len, 0, 0); n = zip_fread(zr_rsrc->zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer)); if (n > 0) { ZSTR_VAL(buffer)[n] = '\0'; @@ -2728,7 +2728,7 @@ static void php_zip_get_from(INTERNAL_FUNCTION_PARAMETERS, int type) /* {{{ */ RETURN_FALSE; } - buffer = zend_string_alloc(len, 0); + buffer = zend_string_safe_alloc(1, len, 0, 0); n = zip_fread(zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer)); if (n < 1) { zend_string_free(buffer); -- cgit v1.2.1