mirror of
https://github.com/php/php-src.git
synced 2024-09-22 18:37:25 +00:00
Fixed bug #62082
This was a buffer overflow in internal function get_icu_disp_value_src_php().
This commit is contained in:
parent
07c0d714a5
commit
86ea921291
@ -527,7 +527,7 @@ static void get_icu_disp_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAME
|
||||
|
||||
/* Get the disp_value for the given locale */
|
||||
do{
|
||||
disp_name = erealloc( disp_name , buflen );
|
||||
disp_name = erealloc( disp_name , buflen * sizeof(UChar) );
|
||||
disp_name_len = buflen;
|
||||
|
||||
if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
|
||||
@ -542,6 +542,7 @@ static void get_icu_disp_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAME
|
||||
buflen = uloc_getDisplayName ( mod_loc_name , disp_loc_name , disp_name , disp_name_len , &status);
|
||||
}
|
||||
|
||||
/* U_STRING_NOT_TERMINATED_WARNING is admissible here; don't look for it */
|
||||
if( U_FAILURE( status ) )
|
||||
{
|
||||
if( status == U_BUFFER_OVERFLOW_ERROR )
|
||||
@ -1562,11 +1563,11 @@ PHP_FUNCTION(locale_lookup)
|
||||
/* }}} */
|
||||
|
||||
/* {{{ proto string Locale::acceptFromHttp(string $http_accept)
|
||||
* Tries to find out best available locale based on HTTP “Accept-Language” header
|
||||
* Tries to find out best available locale based on HTTP <EFBFBD>Accept-Language<EFBFBD> header
|
||||
*/
|
||||
/* }}} */
|
||||
/* {{{ proto string locale_accept_from_http(string $http_accept)
|
||||
* Tries to find out best available locale based on HTTP “Accept-Language” header
|
||||
* Tries to find out best available locale based on HTTP <EFBFBD>Accept-Language<EFBFBD> header
|
||||
*/
|
||||
PHP_FUNCTION(locale_accept_from_http)
|
||||
{
|
||||
|
15
ext/intl/tests/bug62082.phpt
Normal file
15
ext/intl/tests/bug62082.phpt
Normal file
@ -0,0 +1,15 @@
|
||||
--TEST--
|
||||
Bug #62082: Memory corruption in internal get_icu_disp_value_src_php()
|
||||
--SKIPIF--
|
||||
<?php
|
||||
if (!extension_loaded('intl'))
|
||||
die('skip intl extension not enabled');
|
||||
--FILE--
|
||||
<?php
|
||||
var_dump(locale_get_display_name(str_repeat("a", 300), null));
|
||||
var_dump(locale_get_display_name(str_repeat("a", 512), null));
|
||||
var_dump(locale_get_display_name(str_repeat("a", 600), null));
|
||||
--EXPECT--
|
||||
string(300) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
string(512) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
string(600) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
Loading…
Reference in New Issue
Block a user