cvs: php-src(PHP_5_2) /ext/standard string.c

From: Date: Thu, 08 Mar 2007 00:06:41 +0000
Subject: cvs: php-src(PHP_5_2) /ext/standard string.c
Groups: php.cvs 
Request: Send a blank email to [email protected] to get a copy of this message 
iliaa		Thu Mar  8 00:06:41 2007 UTC

  Modified files:              (Branch: PHP_5_2)
    /php-src/ext/standard	string.c 
  Log:
  Improved offset validation
  
  
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.46&r2=1.445.2.14.2.47&diff_format=u
Index: php-src/ext/standard/string.c
diff -u php-src/ext/standard/string.c:1.445.2.14.2.46 php-src/ext/standard/string.c:1.445.2.14.2.47
--- php-src/ext/standard/string.c:1.445.2.14.2.46	Wed Mar  7 18:15:46 2007
+++ php-src/ext/standard/string.c	Thu Mar  8 00:06:41 2007
@@ -18,7 +18,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: string.c,v 1.445.2.14.2.46 2007/03/07 18:15:46 stas Exp $ */
+/* $Id: string.c,v 1.445.2.14.2.47 2007/03/08 00:06:41 iliaa Exp $ */
 
 /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */
 
@@ -4642,11 +4642,13 @@
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset should be greater than or equal to
0.");
 			RETURN_FALSE;		
 		}
-		p += Z_LVAL_PP(offset);
-		if (p > endp) {
+
+		if (Z_LVAL_PP(offset) > Z_STRLEN_PP(haystack)) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset value %ld exceeds string length.",
Z_LVAL_PP(offset));
 			RETURN_FALSE;		
 		}
+		p += Z_LVAL_PP(offset);
+
 		if (ac == 4) {
 			convert_to_long_ex(length);
 			if (Z_LVAL_PP(length) <= 0) {

Thread (1 message)

  • Ilia Alshanetsky
« previous php.cvs (#43456) next »