From 2b8fe11dd87f9f61d711832a085cee78f02d2970 Mon Sep 17 00:00:00 2001 From: Pierre Joye Date: Mon, 26 Sep 2011 08:38:03 +0000 Subject: [PATCH] - Fix bug #55622, better fix for this issue, old fix can break if sizeof(size_t) > sizeof(int) like on sparc --- ext/standard/basic_functions.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c index 277f33eb1e..18282a8daa 100644 --- a/ext/standard/basic_functions.c +++ b/ext/standard/basic_functions.c @@ -5965,7 +5965,7 @@ PHP_FUNCTION(parse_ini_file) PHP_FUNCTION(parse_ini_string) { char *string = NULL, *str = NULL; - size_t str_len = 0; + int str_len = 0; zend_bool process_sections = 0; long scanner_mode = ZEND_INI_SCANNER_NORMAL; zend_ini_parser_cb_t ini_parser_cb; @@ -5974,6 +5974,10 @@ PHP_FUNCTION(parse_ini_string) RETURN_FALSE; } + if (INT_MAX - str_len < ZEND_MMAP_AHEAD) { + RETVAL_FALSE; + } + /* Set callback function */ if (process_sections) { BG(active_ini_file_section) = NULL; -- 2.50.1