]> granicus.if.org Git - php/commitdiff
Merge branch 'PHP-7.0' into PHP-7.1
authorStanislav Malyshev <stas@php.net>
Fri, 4 Nov 2016 05:53:05 +0000 (22:53 -0700)
committerStanislav Malyshev <stas@php.net>
Fri, 4 Nov 2016 05:53:05 +0000 (22:53 -0700)
* PHP-7.0:
  Add length check for bzcompress too - fix for bug #73356
  More string length checks & fixes
  More string length checks & fixes

1  2 
ext/imap/php_imap.c
ext/intl/locale/locale_methods.c
ext/standard/exec.c
ext/zip/php_zip.c

Simple merge
index e35da2fd052358c14e87413d8353389db1d88de1,12cf6c1ce3b4cfc8c9fcc299139cf98988bd015e..6a5cd2e3cb1d0e34c4e56bb7e97a72ae597290a4
@@@ -258,16 -258,19 +258,19 @@@ PHP_NAMED_FUNCTION(zif_locale_set_defau
  */
  static zend_string* get_icu_value_internal( const char* loc_name , char* tag_name, int* result , int fromParseLocale)
  {
 -      zend_string*    tag_value       = NULL;
 -      int32_t         tag_value_len   = 512;
 +      zend_string* tag_value      = NULL;
 +      int32_t      tag_value_len  = 512;
  
 -      int             singletonPos    = 0;
 -      char*           mod_loc_name    = NULL;
 -      int             grOffset        = 0;
 +      zend_off_t   singletonPos   = 0;
 +      char*        mod_loc_name   = NULL;
 +      zend_off_t   grOffset       = 0;
  
 -      int32_t         buflen          = 512;
 -      UErrorCode      status          = U_ZERO_ERROR;
 +      int32_t      buflen         = 512;
 +      UErrorCode   status         = U_ZERO_ERROR;
  
+       if (strlen(loc_name) > INTL_MAX_LOCALE_LEN) {
+               return NULL;
+       }
  
        if( strcmp(tag_name, LOC_CANONICALIZE_TAG) != 0 ){
                /* Handle  grandfathered languages */
Simple merge
Simple merge