Check for string overflow

diff --git a/ext/standard/php_smart_string.h b/ext/standard/php_smart_string.h
index a832376064d3657b133dca0f1eeb998d30c64a53..1175d32907a9acd5640473ca99e583f095876846 100644 (file)
--- a/ext/standard/php_smart_string.h
+++ b/ext/standard/php_smart_string.h
@@ -52,19 +52,22 @@
 #define SMART_STRING_DO_REALLOC(d, what) \
        (d)->c = SMART_STRING_REALLOC((d)->c, (d)->a + 1, (what))
 
-#define smart_string_alloc4(d, n, what, newlen) do {                                   \
+#define smart_string_alloc4(d, n, what, newlen) do {                           \
        if (!(d)->c) {                                                                                                  \
                (d)->len = 0;                                                                                           \
                newlen = (n);                                                                                           \
-               (d)->a = newlen < SMART_STRING_START_SIZE                                               \
-                               ? SMART_STRING_START_SIZE                                                               \
-                               : newlen + SMART_STRING_PREALLOC;                                               \
-               SMART_STRING_DO_REALLOC(d, what);                                                               \
+               (d)->a = newlen < SMART_STRING_START_SIZE                                       \
+                               ? SMART_STRING_START_SIZE                                                       \
+                               : newlen + SMART_STRING_PREALLOC;                                       \
+               SMART_STRING_DO_REALLOC(d, what);                                                       \
        } else {                                                                                                                \
+               if(UNEXPECTED(n > SIZE_MAX - (d)->len)) {                                       \
+                       zend_error(E_ERROR, "String size overflow");                    \
+               }                                                                                                                       \
                newlen = (d)->len + (n);                                                                        \
                if (newlen >= (d)->a) {                                                                         \
-                       (d)->a = newlen + SMART_STRING_PREALLOC;                                        \
-                       SMART_STRING_DO_REALLOC(d, what);                                                       \
+                       (d)->a = newlen + SMART_STRING_PREALLOC;                                \
+                       SMART_STRING_DO_REALLOC(d, what);                                               \
                }                                                                                                                       \
        }                                                                                                                               \
 } while (0)