From abd159cce48f3e34f08e4751c568e09677d5ec9c Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Mon, 9 May 2016 21:55:29 -0700 Subject: [PATCH] Fix bug #72114 - int/size_t confusion in fread --- ext/standard/file.c | 6 ++++++ ext/standard/tests/file/bug72114.phpt | 12 ++++++++++++ 2 files changed, 18 insertions(+) create mode 100644 ext/standard/tests/file/bug72114.phpt diff --git a/ext/standard/file.c b/ext/standard/file.c index 0abc022ca6..e39c84f1cd 100644 --- a/ext/standard/file.c +++ b/ext/standard/file.c @@ -1758,6 +1758,12 @@ PHPAPI PHP_FUNCTION(fread) RETURN_FALSE; } + if (len > INT_MAX) { + /* string length is int in 5.x so we can not read more than int */ + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be no more than %d", INT_MAX); + RETURN_FALSE; + } + Z_STRVAL_P(return_value) = emalloc(len + 1); Z_STRLEN_P(return_value) = php_stream_read(stream, Z_STRVAL_P(return_value), len); diff --git a/ext/standard/tests/file/bug72114.phpt b/ext/standard/tests/file/bug72114.phpt new file mode 100644 index 0000000000..5e591ee478 --- /dev/null +++ b/ext/standard/tests/file/bug72114.phpt @@ -0,0 +1,12 @@ +--TEST-- +Bug #72114 (Integer underflow / arbitrary null write in fread/gzread) +--FILE-- + +Done +--EXPECTF-- +Warning: fread(): Length parameter must be no more than 2147483647 in %s/bug72114.php on line %d +Done -- 2.50.0