Fixed bug #72743 (Out-of-bound read in php_stream_filter_create)

diff --git a/NEWS b/NEWS
index 10961f2c9771e27e2677f0a046c80ec5068c8769..c20b29910ddd75ce646089bba187f628a6c92259 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,10 @@ PHP                                                                        NEWS
 - EXIF:
   . Fixed bug #72735 (Samsung picture thumb not read (zero size)). (Kalle, Remi)
 
+- Stream: 
+  . Fixed bug #72743 (Out-of-bound read in php_stream_filter_create).
+    (Loianhtuan)
+
 04 Aug 2016, PHP 7.1.0beta2
 
 - Core:

diff --git a/main/streams/filter.c b/main/streams/filter.c
index d063c1a915607c21546a688e6a6b045e171ac518..e97dea9f21eb45eed515b635022be47e496d5978 100644 (file)
--- a/main/streams/filter.c
+++ b/main/streams/filter.c
@@ -252,10 +252,10 @@ PHPAPI php_stream_filter *php_stream_filter_create(const char *filtername, zval
        HashTable *filter_hash = (FG(stream_filters) ? FG(stream_filters) : &stream_filters_hash);
        php_stream_filter_factory *factory = NULL;
        php_stream_filter *filter = NULL;
-       int n;
+       size_t n;
        char *period;
 
-       n = (int)strlen(filtername);
+       n = strlen(filtername);
 
        if (NULL != (factory = zend_hash_str_find_ptr(filter_hash, filtername, n))) {
                filter = factory->create_filter(filtername, filterparams, persistent);