Fix #73025: Heap Buffer Overflow in virtual_popen of zend_virtual_cwd.c

`command_length` is retrieved via strlen() and later passed to emalloc()
and memcpy(), so the appropriate type is `size_t`.

We don't add a regression test, because that would need to allocate a string
of at least 2 GiB.

diff --git a/NEWS b/NEWS
index 2689431207502aa26ce51b7a37113f3a486aa981..b11b28380a3feb7750592a03959f2de439365955 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2016, PHP 5.6.27
 
+- Core:
+  . Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of
+    zend_virtual_cwd.c). (cmb)
+
 - Filter:
   . Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
     FILTER_FLAG_NO_PRIV_RANGE). (julien)

diff --git a/Zend/zend_virtual_cwd.c b/Zend/zend_virtual_cwd.c
index 5a5bccecabf880452b492ea08b7826da2168ce2b..875c8da41c5ad9c8a384f6e23272650ab64b7c77 100644 (file)
--- a/Zend/zend_virtual_cwd.c
+++ b/Zend/zend_virtual_cwd.c
@@ -1896,7 +1896,7 @@ CWD_API FILE *virtual_popen(const char *command, const char *type TSRMLS_DC) /*
 #else /* Unix */
 CWD_API FILE *virtual_popen(const char *command, const char *type TSRMLS_DC) /* {{{ */
 {
-       int command_length;
+       size_t command_length;
        int dir_length, extra = 0;
        char *command_line;
        char *ptr, *dir;