Skip to content
Permalink
Browse files

Prevent strrpos and strripos from visiting out-of-bounds memory.

Reviewed By: alexeyt

Differential Revision: D14669668

fbshipit-source-id: 16bb4674bccf83ffd737e60d1fd9fd4a0093f77c
  • Loading branch information...
mjhostet authored and hhvm-bot committed Apr 6, 2019
1 parent a2dc1a0 commit 46003b4ab564b2abcd8470035fc324fe36aa8c75
@@ -21,6 +21,7 @@

#include "hphp/util/lock.h"
#include "hphp/util/overflow.h"
#include <algorithm>
#include <cmath>

#ifndef _MSC_VER
@@ -385,13 +386,13 @@ int string_rfind(const char *input, int len, const char *s, int s_len,
if (pos >= 0) {
ptr = bstrrstr(input + pos, len - pos, s, s_len);
} else {
ptr = bstrrstr(input, len + pos + s_len, s, s_len);
ptr = bstrrstr(input, len + std::min(pos + s_len, 0), s, s_len);
}
} else {
if (pos >= 0) {
ptr = bstrrcasestr(input + pos, len - pos, s, s_len);
} else {
ptr = bstrrcasestr(input, len + pos + s_len, s, s_len);
ptr = bstrrcasestr(input, len + std::min(pos + s_len, 0), s, s_len);
}
}
if (ptr != nullptr) {
@@ -391,6 +391,15 @@ function main_ext_string() {
var_dump(strripos("abcdef abcdef", "A"));
var_dump(strrpos("abc", "c\0", -1));
var_dump(strripos("abc", "c\0", -1));
var_dump(strrpos("abc", "abc", -3));
var_dump(strripos("abc", "abc", -3));
var_dump(strrpos("aaaa", "aa", -1));
var_dump(strripos("aaaa", "aa", -1));
var_dump(strrpos("aaaa", "aa", -2));
var_dump(strripos("aaaa", "aa", -2));
$text = "This is a test";
var_dump(substr_count($text, "is"));
var_dump(substr_count($text, "is", 3));
@@ -220,6 +220,14 @@ int(17)
int(27)
bool(false)
int(7)
bool(false)
bool(false)
int(0)
int(0)
int(2)
int(2)
int(2)
int(2)
int(2)
int(1)
int(0)

0 comments on commit 46003b4

Please sign in to comment.
You can’t perform that action at this time.