Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Fixed bug #62082

This was a buffer overflow in internal function
get_icu_disp_value_src_php().
(cherry picked from commit 86ea921)
  • Loading branch information...
commit 095f7fc965d6eaec6915b0af5b29accfab1703b3 1 parent 5ecabb3
@cataphract cataphract authored johannes committed
Showing with 19 additions and 3 deletions.
  1. +4 −3 ext/intl/locale/locale_methods.c
  2. +15 −0 ext/intl/tests/bug62082.phpt
View
7 ext/intl/locale/locale_methods.c
@@ -527,7 +527,7 @@ static void get_icu_disp_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAME
/* Get the disp_value for the given locale */
do{
- disp_name = erealloc( disp_name , buflen );
+ disp_name = erealloc( disp_name , buflen * sizeof(UChar) );
disp_name_len = buflen;
if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
@@ -542,6 +542,7 @@ static void get_icu_disp_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAME
buflen = uloc_getDisplayName ( mod_loc_name , disp_loc_name , disp_name , disp_name_len , &status);
}
+ /* U_STRING_NOT_TERMINATED_WARNING is admissible here; don't look for it */
if( U_FAILURE( status ) )
{
if( status == U_BUFFER_OVERFLOW_ERROR )
@@ -1562,11 +1563,11 @@ PHP_FUNCTION(locale_lookup)
/* }}} */
/* {{{ proto string Locale::acceptFromHttp(string $http_accept)
-* Tries to find out best available locale based on HTTP “Accept-Language” header
+* Tries to find out best available locale based on HTTP Accept-Language header
*/
/* }}} */
/* {{{ proto string locale_accept_from_http(string $http_accept)
-* Tries to find out best available locale based on HTTP “Accept-Language” header
+* Tries to find out best available locale based on HTTP Accept-Language header
*/
PHP_FUNCTION(locale_accept_from_http)
{
View
15 ext/intl/tests/bug62082.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #62082: Memory corruption in internal get_icu_disp_value_src_php()
+--SKIPIF--
+<?php
+if (!extension_loaded('intl'))
+ die('skip intl extension not enabled');
+--FILE--
+<?php
+var_dump(locale_get_display_name(str_repeat("a", 300), null));
+var_dump(locale_get_display_name(str_repeat("a", 512), null));
+var_dump(locale_get_display_name(str_repeat("a", 600), null));
+--EXPECT--
+string(300) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+string(512) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+string(600) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
Please sign in to comment.
Something went wrong with that request. Please try again.