Fix integer overflow in chunk_split

Reviewed By: @ptarjan Differential Revision: D1515947
facebook · Aug 26, 2014 · 1f91e07 · 1f91e07 · FBNeal · Sep 4, 2014
1 parent 30dff9f
commit 1f91e07
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 2 deletions.
diff --git a/hphp/runtime/base/zend-string.cpp b/hphp/runtime/base/zend-string.cpp
@@ -626,8 +626,14 @@ String string_chunk_split(const char *src, int srclen, const char *end,
   int chunks = srclen / chunklen; // complete chunks!
   int restlen = srclen - chunks * chunklen; /* srclen % chunklen */
 
-  int out_len = (chunks + 1) * endlen + srclen;
-  String ret(out_len, ReserveString);
+  String ret(
+    safe_address(
+      chunks + 1,
+      endlen,
+      srclen
+    ),
+    ReserveString
+  );
   char *dest = ret.bufferSlice().ptr;
 
   const char *p; char *q;

diff --git a/hphp/test/slow/ext_string/chunk_split_overflow.php b/hphp/test/slow/ext_string/chunk_split_overflow.php
@@ -0,0 +1,3 @@
+<?php
+
+chunk_split(str_repeat('*', 2000000), 1.0, str_repeat('*', 2000000));
diff --git a/hphp/test/slow/ext_string/chunk_split_overflow.php.expectf b/hphp/test/slow/ext_string/chunk_split_overflow.php.expectf
@@ -0,0 +1,2 @@
+
+Fatal error: String length exceeded 2^31-2: 4000004000000 in %s on line 3