Merge branch 'PHP-7.1'

* PHP-7.1: Improve fix for #74145 Fix wddx Fix tests Fixed bug #74111 Fix bug #74603 - use correct buffer size Fix bug #74651 - check EVP_SealInit as it can return -1 Update NEWS Fix bug #74087 Fixed parsing of strange formats with mixed month/day and time strings Fix bug #74145 - wddx parsing empty boolean tag leads to SIGSEGV Fixed bug #74111 Fix #74435: Buffer over-read into uninitialized memory Fix bug #74603 - use correct buffer size Fix bug #74651 - check EVP_SealInit as it can return -1 Update NEWS Fix bug #73807
php · Jul 5, 2017 · d75dbb0 · d75dbb0
2 parents 8e0ddc8 + 0ba04f7
commit d75dbb0
Show file tree

Hide file tree

Showing 22 changed files with 5,920 additions and 8,130 deletions.
diff --git a/Zend/tests/bug74603.ini b/Zend/tests/bug74603.ini
@@ -0,0 +1 @@
+0=0&~2000000000
diff --git a/Zend/tests/bug74603.phpt b/Zend/tests/bug74603.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability)
+--SKIPIF--
+<?php
+if (PHP_INT_MAX !== 2147483647)
+        die('skip for 32-bit only');
+--FILE--
+<?php
+var_dump(parse_ini_file(__DIR__ . "/bug74603.ini", true, INI_SCANNER_NORMAL));
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(1) "0"
+}
diff --git a/Zend/zend_ini_parser.y b/Zend/zend_ini_parser.y
@@ -55,7 +55,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 	int i_result;
 	int i_op1, i_op2;
 	int str_len;
-	char str_result[MAX_LENGTH_OF_LONG];
+	char str_result[MAX_LENGTH_OF_LONG+1];
 
 	i_op1 = atoi(Z_STRVAL_P(op1));
 	zend_string_free(Z_STR_P(op1));