From: Stanislav Malyshev <stas@php.net>
Date: Mon, 12 May 2014 00:54:27 +0000 (-0700)
Subject: Fix bug #67247	spl_fixedarray_resize integer overflow
X-Git-Tag: php-5.3.29RC1~19
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=84605098bc81517919ecb43935682fdd8a249f9d;p=php

Fix bug #67247	spl_fixedarray_resize integer overflow
---

diff --git a/ext/spl/spl_fixedarray.c b/ext/spl/spl_fixedarray.c
index 646c002f6f..526ed8596f 100644
--- a/ext/spl/spl_fixedarray.c
+++ b/ext/spl/spl_fixedarray.c
@@ -116,7 +116,7 @@ static void spl_fixedarray_resize(spl_fixedarray *array, long size TSRMLS_DC) /*
 			array->elements = NULL;
 		}
 	} else if (size > array->size) {
-		array->elements = erealloc(array->elements, sizeof(zval *) * size);
+		array->elements = safe_erealloc(array->elements, size, sizeof(zval *), 0);
 		memset(array->elements + array->size, '\0', sizeof(zval *) * (size - array->size));
 	} else { /* size < array->size */
 		long i;
diff --git a/ext/spl/tests/bug67247.phpt b/ext/spl/tests/bug67247.phpt
new file mode 100644
index 0000000000..cb71445d7b
--- /dev/null
+++ b/ext/spl/tests/bug67247.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #67247 (spl_fixedarray_resize integer overflow)
+--FILE--
+<?php
+$ar = new SplFixedArray(1);
+echo "size: ".$ar->getSize()."\n";
+$ar->setSize((PHP_INT_SIZE==8)?0x2000000000000001:0x40000001);
+echo "size: ".$ar->getSize()."\n";
+?>
+--EXPECTF--
+size: 1
+
+Fatal error: Possible integer overflow in memory allocation (%d * %d + 0) in %s on line %d