From: Ilia Alshanetsky <iliaa@php.net>
Date: Sun, 21 May 2006 16:10:28 +0000 (+0000)
Subject: Fixed a possible buffer overflow inside create_named_pipe() for Win32
X-Git-Tag: php-4.4.3RC1~3
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a2e5235b927deedc1decdf655c8283b19adc9069;p=php

Fixed a possible buffer overflow inside create_named_pipe() for Win32
systems in libmysql.c.
---

diff --git a/NEWS b/NEWS
index 4557cf66b9..2ee7e5de68 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2006, Version 4.4.3
+- Fixed a possible buffer overflow inside create_named_pipe() for Win32 systems
+  in libmysql.c. (Ilia)
 - Updated PCRE to version 6.6. (Andrei)
 - Added overflow checks to wordwrap() function. (Ilia)
 - Added a check for special characters in the session name. (Ilia)
diff --git a/ext/mysql/libmysql/libmysql.c b/ext/mysql/libmysql/libmysql.c
index 94d6352252..a1f7a4520c 100644
--- a/ext/mysql/libmysql/libmysql.c
+++ b/ext/mysql/libmysql/libmysql.c
@@ -213,6 +213,10 @@ HANDLE create_named_pipe(NET *net, uint connect_timeout, char **arg_host,
   if (!host || !strcmp(host,LOCAL_HOST))
     host=LOCAL_HOST_NAMEDPIPE;
 
+  if (sizeof(szPipeName) <= (strlen(host) + strlen(unix_socket) + sizeof("\\\\\\pipe\\"))) {
+	return INVALID_HANDLE_VALUE;
+  }
+
   sprintf( szPipeName, "\\\\%s\\pipe\\%s", host, unix_socket);
   DBUG_PRINT("info",("Server name: '%s'.  Named Pipe: %s",
 		     host, unix_socket));