Fix bug #69248 - heap overflow vulnerability in regcomp.c

Merged from https://github.com/garyhouston/regex/commit/70bc2965604b6b8aaf260049e64c708dddf85334

diff --git a/NEWS b/NEWS
index 5d4925b846a0415c13a37e5b7fd96378d7855fa7..06857ccf016610db2b16968213b25ce7d767615b 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,9 @@ PHP                                                                        NEWS
     configuration options). (Anatol Belski)
   . Fixed bug #69207 (move_uploaded_file allows nulls in path). (Stas)
 
+- Ereg:
+  . Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (Stas)
+
 - SOAP:
   . Fixed bug #69085 (SoapClient's __call() type confusion through
     unserialize()). (Dmitry)

diff --git a/ext/ereg/regex/regcomp.c b/ext/ereg/regex/regcomp.c
index 156eee93292a2c0cd7c4514250a5c07cc8f99fcc..f4bfc1c1679ffedfff020a7c1c73811075cb7710 100644 (file)
--- a/ext/ereg/regex/regcomp.c
+++ b/ext/ereg/regex/regcomp.c
@@ -117,7 +117,15 @@ int cflags;
                                                        (NC-1)*sizeof(cat_t));
        if (g == NULL)
                return(REG_ESPACE);
-       p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
+       {
+               /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */
+               size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
+               if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) {
+                       free((char *) g);
+                       return REG_INVARG;
+               }
+               p->ssize = new_ssize;
+       }
        p->strip = (sop *)malloc(p->ssize * sizeof(sop));
        p->slen = 0;
        if (p->strip == NULL) {