From: Stanislav Malyshev <stas@php.net>
Date: Wed, 20 Apr 2016 06:49:22 +0000 (-0700)
Subject: Fix bug #71923 - integer overflow in ZipArchive::getFrom*
X-Git-Tag: php-7.0.7RC1~71
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ccc12efa32f855e6057cb9b7e1e45afe08503a00;p=php

Fix bug #71923 - integer overflow in ZipArchive::getFrom*
---

diff --git a/ext/zip/php_zip.c b/ext/zip/php_zip.c
index db201af634..7c9adf4af7 100644
--- a/ext/zip/php_zip.c
+++ b/ext/zip/php_zip.c
@@ -1281,7 +1281,7 @@ static PHP_NAMED_FUNCTION(zif_zip_entry_read)
 	}
 
 	if (zr_rsrc->zf) {
-		buffer = zend_string_alloc(len, 0);
+		buffer = zend_string_safe_alloc(1, len, 0, 0);
 		n = zip_fread(zr_rsrc->zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer));
 		if (n > 0) {
 			ZSTR_VAL(buffer)[n] = '\0';
@@ -2728,7 +2728,7 @@ static void php_zip_get_from(INTERNAL_FUNCTION_PARAMETERS, int type) /* {{{ */
 		RETURN_FALSE;
 	}
 
-	buffer = zend_string_alloc(len, 0);
+	buffer = zend_string_safe_alloc(1, len, 0, 0);
 	n = zip_fread(zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer));
 	if (n < 1) {
 		zend_string_free(buffer);