PHP :: Bug #51002 :: An int variable is used as size

Bug #51002	An int variable is used as size_t in child function
Submitted:	2010-02-10 20:07 UTC	Modified:	2010-06-15 20:46 UTC
From:	[email protected]	Assigned:	pajoye (profile)
Status:	Closed	Package:	Zip Related
PHP Version:	5.3.2RC1	OS:	*
Private report:	No	CVE-ID:	None

View Developer Edit

[2010-02-10 20:07 UTC] [email protected]

Description:
------------
In php_zip_add_from_pattern() a pointer to file_stripped_len is passed
to php_based which treats the address as a size_t. If the size of int
differs from the size of size_t then this could cause a memory access
error.

int entry_name_len,file_stripped_len;
...

php_basename(Z_STRVAL_PP(zval_file), Z_STRLEN_PP(zval_file), NULL, 0,
   &basename, (size_t *)&file_stripped_len TSRMLS_CC)

This is related to Rasmus's fix
http://svn.php.net/viewvc?view=revision&revision=294816

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2010-02-10 20:12 UTC] [email protected]

Assign to maintainer

[2010-02-12 17:10 UTC] [email protected]

There is no such OS called 'n/a'.

[2010-06-15 20:46 UTC] [email protected]

-Status: Assigned +Status: Closed

[2010-06-15 20:46 UTC] [email protected]

This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

[2010-06-15 20:50 UTC] [email protected]

Automatic comment from SVN on behalf of pajoye
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=300470
Log: - Fix #51002, fix possible memory corruption with very long names

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2025 The PHP Group All rights reserved.	Last updated: Wed Dec 31 05:00:01 2025 UTC