From a857541f5f69cf94edb0996fc87de18f9bddb3fb Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Sun, 31 Dec 2006 22:26:25 +0000 Subject: [PATCH] MFH: Added boundary checks to php_binary deserializer --- ext/session/session.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ext/session/session.c b/ext/session/session.c index 1d60e08500..3d97c9e041 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -424,6 +424,11 @@ PS_SERIALIZER_DECODE_FUNC(php_binary) for (p = val; p < endptr; ) { zval **tmp; namelen = *p & (~PS_BIN_UNDEF); + + if (namelen > PS_BIN_MAX || (p + namelen) >= endptr) { + return FAILURE; + } + has_value = *p & PS_BIN_UNDEF ? 0 : 1; name = estrndup(p + 1, namelen); -- 2.50.1