From: Felipe Pena <felipe@php.net>
Date: Tue, 24 May 2011 00:05:50 +0000 (+0000)
Subject: - Fixed stack buffer overflow in socket_connect().
X-Git-Tag: php-5.4.0alpha1~144
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=70f4069138249b348c4a10888aeeb4b3cc546ae5;p=php

- Fixed stack buffer overflow in socket_connect().
  Found by: Mateusz Kocielski, Marek Kroemeke and Filip Palian
---

diff --git a/ext/sockets/sockets.c b/ext/sockets/sockets.c
index 0c6f292f38..1651ca9db4 100644
--- a/ext/sockets/sockets.c
+++ b/ext/sockets/sockets.c
@@ -1540,6 +1540,11 @@ PHP_FUNCTION(socket_connect)
 			break;
 
 		case AF_UNIX:
+			if (addr_len >= sizeof(s_un.sun_path)) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Path too long", php_sock->type);
+				RETURN_FALSE;
+			}
+				
 			memset(&s_un, 0, sizeof(struct sockaddr_un));
 
 			s_un.sun_family = AF_UNIX;