From 8a6c8364970bc342cc7e611cf7678b177b75fb8f Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Mon, 17 Mar 2008 23:07:55 +0000 Subject: [PATCH] fix integer overflow in lenght calculation --- ext/standard/formatted_print.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c index 396a2529b4..b6ec457177 100644 --- a/ext/standard/formatted_print.c +++ b/ext/standard/formatted_print.c @@ -94,6 +94,7 @@ php_sprintf_appendstring(char **buffer, int *pos, int *size, char *add, register int npad; int req_size; int copy_len; + int m_width; copy_len = (expprec ? MIN(max_width, len) : len); npad = min_width - copy_len; @@ -104,11 +105,19 @@ php_sprintf_appendstring(char **buffer, int *pos, int *size, char *add, PRINTF_DEBUG(("sprintf: appendstring(%x, %d, %d, \"%s\", %d, '%c', %d)\n", *buffer, *pos, *size, add, min_width, padding, alignment)); + m_width = MAX(min_width, copy_len); - req_size = *pos + MAX(min_width, copy_len) + 1; + if(m_width > INT_MAX - *pos - 1) { + zend_error_noreturn(E_ERROR, "Field width %d is too long", m_width); + } + + req_size = *pos + m_width + 1; if (req_size > *size) { while (req_size > *size) { + if(*size > INT_MAX/2) { + zend_error_noreturn(E_ERROR, "Field width %d is too long", req_size); + } *size <<= 1; } PRINTF_DEBUG(("sprintf ereallocing buffer to %d bytes\n", *size)); -- 2.50.1