MFH: Fixed bug #29821 (Fixed possible crashes in convert_uudecode() on

invalid data).

diff --git a/NEWS b/NEWS
index 82940287f1066e7ffa2de40e28d4d3e116bf649d..cd832d20567b252f6ad618186ae0f9bd6eeee5bf 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ PHP                                                                        NEWS
   (Paul Hudson, Derick)
 - Fixed bug with raw_post_data not getting set (Brian)
 - Fixed a file-descriptor leak with phpinfo() and other 'special' URLs (Zeev)
+- Fixed bug #29821 (Fixed possible crashes in convert_uudecode() on invalid
+  data). (Ilia)
 - Fixed bug #29737 (ip2long should return -1 if IP is 255.255.255.255 and FALSE
   on error). (Tony)
 - Fixed bug #29711 (Changed ext/xml to default to UTF-8 output). (Rob)

diff --git a/ext/standard/uuencode.c b/ext/standard/uuencode.c
index 544fda1cac0bf6d684ae746e48e1028c042159b3..9606fbaccb2d89eb95f24324fca55ba075088dc7 100644 (file)
--- a/ext/standard/uuencode.c
+++ b/ext/standard/uuencode.c
@@ -136,9 +136,18 @@ PHPAPI int php_uudecode(char *src, int src_len, char **dest)
                if ((len = PHP_UU_DEC(*s++)) <= 0) {
                        break;
                }
+               /* sanity check */
+               if (len > src_len) {
+                       goto err;
+               }
+
                total_len += len;
 
                ee = s + (len == 45 ? 60 : (int) floor(len * 1.33));
+               /* sanity check */
+               if (ee > e) {
+                       goto err;
+               }
 
                while (s < ee) {
                        *p++ = PHP_UU_DEC(*s) << 2 | PHP_UU_DEC(*(s + 1)) >> 4;
@@ -168,6 +177,10 @@ PHPAPI int php_uudecode(char *src, int src_len, char **dest)
        *(*dest + total_len) = '\0';
 
        return total_len;
+
+err:
+       efree(*dest);
+       return -1;
 }
 
 /* {{{ proto string uuencode(string data) 
@@ -199,6 +212,10 @@ PHP_FUNCTION(convert_uudecode)
        }
 
        dst_len = php_uudecode(src, src_len, &dst);
+       if (dst_len < 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "The given parameter is not a valid uuencoded string.");
+               RETURN_FALSE;
+       }
 
        RETURN_STRINGL(dst, dst_len, 0);
 }