MFH:

	Fixed bug #21760 (Use of uninitialized pointer inside php_read()).
	Fixed 3 possible crashes due to integer overflow or invalid user input
	inside the sockets extension.

diff --git a/NEWS b/NEWS
index d12ef3c31c2ab839482466b620d7d1432c1cf968..40d8c0d7c740501eb8a03c99b49ed324bb3c4ec1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Feb 2004, Version 4.3.5
+- Fixed possible crashes inside socket extension, due to missing check inside
+  allocation functions. (Ilia)
 - Fixed bug #27384 (unpack() misbehaves with 1 char string). (GeorgeS)
 - Fixed bug #27383 (Potential crash inside fopen_wrapper, while parsing
   response code). (Ilia)
@@ -16,6 +18,8 @@ PHP 4                                                                      NEWS
   (Jani, Markus dot Lidel at shadowconnect dot com)
 - Fixed bug #26005 (Random "cannot change the session ini settings" errors).
   (Jani, jsnajdr at kerio dot com)
+- Fixed bug #21760 (Use of uninitialized pointer inside php_read()). (Ilia, 
+  uce at ftc dot gov)
 
 16 Feb 2004, Version 4.3.5RC3
 - Fixed zero bytes memory allocation when no extra ini files are found in the

diff --git a/ext/sockets/sockets.c b/ext/sockets/sockets.c
index f2e1a706aec5b4483f0d057242fde3f6c272b1ef..419b55fea2d1b2ea6c02bd821cb61c9544c37d65 100644 (file)
--- a/ext/sockets/sockets.c
+++ b/ext/sockets/sockets.c
@@ -294,6 +294,7 @@ static int php_read(int bsd_socket, void *buf, size_t maxlen, int flags)
 
        set_errno(0);
 
+       *t = '\0';
        while (*t != '\n' && *t != '\r' && n < maxlen) {
                if (m > 0) {
                        t++;
@@ -808,7 +809,10 @@ PHP_FUNCTION(socket_read)
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rl|l", &arg1, &length, &type) == FAILURE)
                return;
 
-       if(length<0) RETURN_FALSE;
+       /* overflow check */
+       if((length + 1) < 2) {
+               RETURN_FALSE;
+       }
        tmpbuf = emalloc(length + 1);
        
        ZEND_FETCH_RESOURCE(php_sock, php_socket *, &arg1, -1, le_socket_name, le_socket);
@@ -1372,6 +1376,11 @@ PHP_FUNCTION(socket_recv)
 
        ZEND_FETCH_RESOURCE(php_sock, php_socket *, &php_sock_res, -1, le_socket_name, le_socket);
 
+       /* overflow check */
+       if ((len + 1) < 2) {
+               RETURN_FALSE;
+       }
+
        recv_buf = emalloc(len + 1);
        memset(recv_buf, 0, len + 1);
 
@@ -1446,6 +1455,11 @@ PHP_FUNCTION(socket_recvfrom)
 
        if(arg3<0) RETURN_FALSE;
 
+       /* overflow check */
+       if ((arg3 + 2) < 3) {
+               RETURN_FALSE;
+       }
+
        recv_buf = emalloc(arg3 + 2);
        memset(recv_buf, 0, arg3 + 2);