From 2ca8d85dd4ac6d5f8c046f339f9636e3099b0f08 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Tue, 12 Jul 2016 22:59:19 -0700 Subject: [PATCH] Fix bug #72541 - size_t overflow lead to heap corruption --- ext/curl/interface.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ext/curl/interface.c b/ext/curl/interface.c index 6a616411ef..7d085de73c 100644 --- a/ext/curl/interface.c +++ b/ext/curl/interface.c @@ -3595,6 +3595,10 @@ PHP_FUNCTION(curl_unescape) RETURN_FALSE; } + if (str_len > INT_MAX) { + RETURN_FALSE; + } + if ((out = curl_easy_unescape(ch->cp, str, str_len, &out_len))) { RETVAL_STRINGL(out, out_len); curl_free(out); -- 2.50.1