From 89f893a95e8dcfff71f48d98ea87c5e1a6a88b32 Mon Sep 17 00:00:00 2001 From: Felipe Pena Date: Tue, 24 May 2011 00:05:50 +0000 Subject: [PATCH] - Fixed stack buffer overflow in socket_connect(). Found by: Mateusz Kocielski, Marek Kroemeke and Filip Palian --- ext/sockets/sockets.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ext/sockets/sockets.c b/ext/sockets/sockets.c index 0c6f292f38..1651ca9db4 100644 --- a/ext/sockets/sockets.c +++ b/ext/sockets/sockets.c @@ -1540,6 +1540,11 @@ PHP_FUNCTION(socket_connect) break; case AF_UNIX: + if (addr_len >= sizeof(s_un.sun_path)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Path too long", php_sock->type); + RETURN_FALSE; + } + memset(&s_un, 0, sizeof(struct sockaddr_un)); s_un.sun_family = AF_UNIX; -- 2.50.1