Skip to content

Commit

Permalink
Avoid OOB reads in create_name_with_username()
Browse files Browse the repository at this point in the history
`accel_uname_id` and `zend_system_id` are MD5 buffers which are not
NUL terminated.  Thus, we must not pass them to `snprintf()`.

Closes GH-6968.
  • Loading branch information
cmb69 committed Jul 4, 2021
1 parent 96bf925 commit b184073
Showing 1 changed file with 13 additions and 2 deletions.
15 changes: 13 additions & 2 deletions ext/opcache/shared_alloc_win32.c
Original file line number Diff line number Diff line change
Expand Up @@ -70,8 +70,19 @@ static void zend_win_error_message(int type, char *msg, int err)

static char *create_name_with_username(char *name)
{
static char newname[MAXPATHLEN + 32 + 4 + 1 + 32 + 21];
snprintf(newname, sizeof(newname) - 1, "%s@%.32s@%.20s@%.32s", name, accel_uname_id, sapi_module.name, accel_system_id);
static char newname[MAXPATHLEN + 1 + 32 + 1 + 20 + 1 + 32 + 1];
char *p = newname;
p += strlcpy(newname, name, MAXPATHLEN + 1);
*(p++) = '@';
memcpy(p, accel_uname_id, 32);
p += 32;
*(p++) = '@';
p += strlcpy(p, sapi_module.name, 21);
*(p++) = '@';
memcpy(p, accel_system_id, 32);
p += 32;
*(p++) = '\0';
ZEND_ASSERT(p - newname <= sizeof(newname));

return newname;
}
Expand Down

0 comments on commit b184073

Please sign in to comment.