From: Felipe Pena <felipe@php.net>
Date: Tue, 24 May 2011 00:05:50 +0000 (+0000)
Subject: - Fixed stack buffer overflow in socket_connect().
X-Git-Tag: php-5.3.7RC1~87
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e9f4cfd6afae2efc6fe7bf9de5ba8944f3781c1f;p=php

- Fixed stack buffer overflow in socket_connect().
  Found by: Mateusz Kocielski, Marek Kroemeke and Filip Palian
---

diff --git a/NEWS b/NEWS
index f0cd89ba67..d555f020d5 100644
--- a/NEWS
+++ b/NEWS
@@ -118,6 +118,8 @@ PHP                                                                        NEWS
   . Fixed bug #54312 (soap_version logic bug). (tom at samplonius dot org)
 
 - Sockets extension:
+  . Fixed stack buffer overflow in socket_connect().
+    Found by Mateusz Kocielski, Marek Kroemeke and Filip Palian. (Felipe)
   . Changed socket_set_block() and socket_set_nonblock() so they emit warnings
     on error. (Gustavo)
   . Fixed bug #51958 (socket_accept() fails on IPv6 server sockets). (Gustavo)
diff --git a/ext/sockets/sockets.c b/ext/sockets/sockets.c
index 91ae979827..048afe1c5f 100644
--- a/ext/sockets/sockets.c
+++ b/ext/sockets/sockets.c
@@ -1336,6 +1336,11 @@ PHP_FUNCTION(socket_connect)
 			break;
 
 		case AF_UNIX:
+			if (addr_len >= sizeof(s_un.sun_path)) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Path too long", php_sock->type);
+				RETURN_FALSE;
+			}
+				
 			memset(&s_un, 0, sizeof(struct sockaddr_un));
 
 			s_un.sun_family = AF_UNIX;