From: Ilia Alshanetsky <iliaa@php.net>
Date: Sun, 31 Dec 2006 22:26:25 +0000 (+0000)
Subject: MFH: Added boundary checks to php_binary deserializer
X-Git-Tag: php-4.4.5RC1~10
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a857541f5f69cf94edb0996fc87de18f9bddb3fb;p=php

MFH: Added boundary checks to php_binary deserializer
---

diff --git a/ext/session/session.c b/ext/session/session.c
index 1d60e08500..3d97c9e041 100644
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -424,6 +424,11 @@ PS_SERIALIZER_DECODE_FUNC(php_binary)
 	for (p = val; p < endptr; ) {
 		zval **tmp;
 		namelen = *p & (~PS_BIN_UNDEF);
+
+		if (namelen > PS_BIN_MAX || (p + namelen) >= endptr) {
+			return FAILURE;
+		}
+
 		has_value = *p & PS_BIN_UNDEF ? 0 : 1;
 
 		name = estrndup(p + 1, namelen);