Fix potential integer overflow in nl2br

The buffer size was calculated manually, thus creating integer overflows
for very large inputs, e.g. nl2br(str_repeat("\n", 613566757)).

The code now uses safe_emalloc, thus making the code throw an error
instead of crashing.

diff --git a/ext/standard/string.c b/ext/standard/string.c
index a521d78261bc17be441ccd36e25a2825fed2c9d1..1a7bd1e0b471bb3673e6fe66b5da91af22dfd90b 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4001,13 +4001,12 @@ PHP_FUNCTION(nl2br)
                RETURN_STRINGL(str, str_len, 1);
        }
 
-       if (is_xhtml) {
-               new_length = str_len + repl_cnt * (sizeof("<br />") - 1);
-       } else {
-               new_length = str_len + repl_cnt * (sizeof("<br>") - 1);
-       }
+       {
+               size_t repl_len = is_xhtml ? (sizeof("<br />") - 1) : (sizeof("<br>") - 1);
 
-       tmp = target = emalloc(new_length + 1);
+               new_length = str_len + repl_cnt * repl_len;
+               tmp = target = safe_emalloc(repl_cnt, repl_len, str_len + 1);
+       }
 
        while (str < end) {
                switch (*str) {