Fix bug #77418 - Heap overflow in utf32be_mbc_to_code

diff --git a/NEWS b/NEWS
index 245aecc2288308b785c523feef7700c8b65d063c..53b26b7c5cf0045c53d93182973ccb7214168f93 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,19 +3,20 @@ PHP                                                                        NEWS
 ?? ??? 2018, PHP 5.6.40
 
 - GD:
-  . Fixed bug #77269 (efree() on uninitialized Heap data in imagescale leads to 
+  . Fixed bug #77269 (efree() on uninitialized Heap data in imagescale leads to
     use-after-free). (cmb)
   . Fixed bug #77270 (imagecolormatch Out Of Bounds Write on Heap). (cmb)
 
 - Mbstring:
   . Fixed bug #77370 (Buffer overflow on mb regex functions - fetch_token). (Stas)
-  . Fixed bug #77371 (heap buffer overflow in mb regex functions 
+  . Fixed bug #77371 (heap buffer overflow in mb regex functions
     - compile_string_node). (Stas)
   . Fixed bug #77381 (heap buffer overflow in multibyte match_at). (Stas)
-  . Fixed bug #77382 (heap buffer overflow due to incorrect length in 
+  . Fixed bug #77382 (heap buffer overflow due to incorrect length in
     expand_case_fold_string). (Stas)
   . Fixed bug #77385 (buffer overflow in fetch_token). (Stas)
   . Fixed bug #77394 (Buffer overflow in multibyte case folding - unicode). (Stas)
+  . Fixed bug #77418 (Heap overflow in utf32be_mbc_to_code). (Stas)
 
 - Phar:
   . Fixed bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext). (Stas)

diff --git a/ext/mbstring/oniguruma/enc/utf16_be.c b/ext/mbstring/oniguruma/enc/utf16_be.c
index 1e909ebbf29307414503e49ba714dccf52e57e20..9e2f73b0735e22fb051617d31be0dab7ea7df9f3 100644 (file)
--- a/ext/mbstring/oniguruma/enc/utf16_be.c
+++ b/ext/mbstring/oniguruma/enc/utf16_be.c
@@ -75,16 +75,18 @@ utf16be_is_mbc_newline(const UChar* p, const UChar* end)
 }
 
 static OnigCodePoint
-utf16be_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
+utf16be_mbc_to_code(const UChar* p, const UChar* end)
 {
   OnigCodePoint code;
 
   if (UTF16_IS_SURROGATE_FIRST(*p)) {
+    if (end - p < 4) return 0;
     code = ((((p[0] - 0xd8) << 2) + ((p[1] & 0xc0) >> 6) + 1) << 16)
          + ((((p[1] & 0x3f) << 2) + (p[2] - 0xdc)) << 8)
          + p[3];
   }
   else {
+    if (end - p < 2) return 0;
     code = p[0] * 256 + p[1];
   }
   return code;

diff --git a/ext/mbstring/oniguruma/enc/utf16_le.c b/ext/mbstring/oniguruma/enc/utf16_le.c
index 5cc07591173a01fdbe6316cea2495bd815fd0937..580f8dffa2f44c4d820680cd856618a344764869 100644 (file)
--- a/ext/mbstring/oniguruma/enc/utf16_le.c
+++ b/ext/mbstring/oniguruma/enc/utf16_le.c
@@ -81,13 +81,14 @@ utf16le_is_mbc_newline(const UChar* p, const UChar* end)
 }
 
 static OnigCodePoint
-utf16le_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
+utf16le_mbc_to_code(const UChar* p, const UChar* end)
 {
   OnigCodePoint code;
   UChar c0 = *p;
   UChar c1 = *(p+1);
 
   if (UTF16_IS_SURROGATE_FIRST(c1)) {
+    if (end - p < 4) return 0;
     code = ((((c1 - 0xd8) << 2) + ((c0  & 0xc0) >> 6) + 1) << 16)
          + ((((c0 & 0x3f) << 2) + (p[3] - 0xdc)) << 8)
          + p[2];

diff --git a/ext/mbstring/oniguruma/enc/utf32_be.c b/ext/mbstring/oniguruma/enc/utf32_be.c
index b4f822607c89467d98e697c8c0610cd4481c12fc..5295f26b1e59ee878efca2fb9e79ebfbc4b774ba 100644 (file)
--- a/ext/mbstring/oniguruma/enc/utf32_be.c
+++ b/ext/mbstring/oniguruma/enc/utf32_be.c
@@ -60,6 +60,7 @@ utf32be_is_mbc_newline(const UChar* p, const UChar* end)
 static OnigCodePoint
 utf32be_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
 {
+  if (end - p < 4) return 0;
   return (OnigCodePoint )(((p[0] * 256 + p[1]) * 256 + p[2]) * 256 + p[3]);
 }
 

diff --git a/ext/mbstring/oniguruma/enc/utf32_le.c b/ext/mbstring/oniguruma/enc/utf32_le.c
index 8f413bfc74e12b1cfc8cabb8d3c284dcb67681cd..a78c4d0abcc7c48ab34c0d755bef5e44bb4e2a6a 100644 (file)
--- a/ext/mbstring/oniguruma/enc/utf32_le.c
+++ b/ext/mbstring/oniguruma/enc/utf32_le.c
@@ -60,6 +60,7 @@ utf32le_is_mbc_newline(const UChar* p, const UChar* end)
 static OnigCodePoint
 utf32le_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
 {
+  if (end - p < 4) return 0;
   return (OnigCodePoint )(((p[3] * 256 + p[2]) * 256 + p[1]) * 256 + p[0]);
 }
 

diff --git a/ext/mbstring/tests/bug77418.phpt b/ext/mbstring/tests/bug77418.phpt
new file mode 100644 (file)
index 0000000..b4acc45
--- /dev/null
+++ b/ext/mbstring/tests/bug77418.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #77371 (Heap overflow in utf32be_mbc_to_code)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+mb_regex_encoding("UTF-32");
+var_dump(mb_split("\x00\x00\x00\x5c\x00\x00\x00B","000000000000000000000000000000"));
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(30) "000000000000000000000000000000"
+}