- Fix bug #55622, better fix for this issue, old fix can break if sizeof(size_t)...

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index 277f33eb1ed852f44785cdc03105d86c3e3197c9..18282a8daad4c68ee48a10d74d60375692d6324f 100644 (file)
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -5965,7 +5965,7 @@ PHP_FUNCTION(parse_ini_file)
 PHP_FUNCTION(parse_ini_string)
 {
        char *string = NULL, *str = NULL;
-       size_t str_len = 0;
+       int str_len = 0;
        zend_bool process_sections = 0;
        long scanner_mode = ZEND_INI_SCANNER_NORMAL;
        zend_ini_parser_cb_t ini_parser_cb;
@@ -5974,6 +5974,10 @@ PHP_FUNCTION(parse_ini_string)
                RETURN_FALSE;
        }
 
+       if (INT_MAX - str_len < ZEND_MMAP_AHEAD) {
+               RETVAL_FALSE;
+       }
+
        /* Set callback function */
        if (process_sections) {
                BG(active_ini_file_section) = NULL;