Skip to content

Commit 46003b4

Browse files
mjhostethhvm-bot
authored andcommitted
Prevent strrpos and strripos from visiting out-of-bounds memory.
Reviewed By: alexeyt Differential Revision: D14669668 fbshipit-source-id: 16bb4674bccf83ffd737e60d1fd9fd4a0093f77c
1 parent a2dc1a0 commit 46003b4

File tree

3 files changed

+20
-2
lines changed

3 files changed

+20
-2
lines changed

Diff for: hphp/runtime/base/zend-string.cpp

+3-2
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121

2222
#include "hphp/util/lock.h"
2323
#include "hphp/util/overflow.h"
24+
#include <algorithm>
2425
#include <cmath>
2526

2627
#ifndef _MSC_VER
@@ -385,13 +386,13 @@ int string_rfind(const char *input, int len, const char *s, int s_len,
385386
if (pos >= 0) {
386387
ptr = bstrrstr(input + pos, len - pos, s, s_len);
387388
} else {
388-
ptr = bstrrstr(input, len + pos + s_len, s, s_len);
389+
ptr = bstrrstr(input, len + std::min(pos + s_len, 0), s, s_len);
389390
}
390391
} else {
391392
if (pos >= 0) {
392393
ptr = bstrrcasestr(input + pos, len - pos, s, s_len);
393394
} else {
394-
ptr = bstrrcasestr(input, len + pos + s_len, s, s_len);
395+
ptr = bstrrcasestr(input, len + std::min(pos + s_len, 0), s, s_len);
395396
}
396397
}
397398
if (ptr != nullptr) {

Diff for: hphp/test/slow/ext_string/ext_string.php

+9
Original file line numberDiff line numberDiff line change
@@ -391,6 +391,15 @@ function main_ext_string() {
391391

392392
var_dump(strripos("abcdef abcdef", "A"));
393393

394+
var_dump(strrpos("abc", "c\0", -1));
395+
var_dump(strripos("abc", "c\0", -1));
396+
var_dump(strrpos("abc", "abc", -3));
397+
var_dump(strripos("abc", "abc", -3));
398+
var_dump(strrpos("aaaa", "aa", -1));
399+
var_dump(strripos("aaaa", "aa", -1));
400+
var_dump(strrpos("aaaa", "aa", -2));
401+
var_dump(strripos("aaaa", "aa", -2));
402+
394403
$text = "This is a test";
395404
var_dump(substr_count($text, "is"));
396405
var_dump(substr_count($text, "is", 3));

Diff for: hphp/test/slow/ext_string/ext_string.php.expectf

+8
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,14 @@ int(17)
220220
int(27)
221221
bool(false)
222222
int(7)
223+
bool(false)
224+
bool(false)
225+
int(0)
226+
int(0)
227+
int(2)
228+
int(2)
229+
int(2)
230+
int(2)
223231
int(2)
224232
int(1)
225233
int(0)

0 commit comments

Comments
 (0)