blob: e3309f408271db5b0cc8680b2ac588e16b569553 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
From fb04dcf6dbb48aecd8d2dc986806cb58c8ae5282 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Tue, 17 Mar 2015 17:04:57 -0700
Subject: [PATCH] Fix bug #69248 - heap overflow vulnerability in regcomp.c
Merged from https://github.com/garyhouston/regex/commit/70bc2965604b6b8aaf260049e64c708dddf85334
---
NEWS | 3 +++
ext/ereg/regex/regcomp.c | 10 +++++++++-
2 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/ext/ereg/regex/regcomp.c b/ext/ereg/regex/regcomp.c
index 156eee9..f4bfc1c 100644
--- a/ext/ereg/regex/regcomp.c
+++ b/ext/ereg/regex/regcomp.c
@@ -117,7 +117,15 @@ int cflags;
(NC-1)*sizeof(cat_t));
if (g == NULL)
return(REG_ESPACE);
- p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
+ {
+ /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */
+ size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
+ if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) {
+ free((char *) g);
+ return REG_INVARG;
+ }
+ p->ssize = new_ssize;
+ }
p->strip = (sop *)malloc(p->ssize * sizeof(sop));
p->slen = 0;
if (p->strip == NULL) {
--
2.1.4
|