clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-21 09:57:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3'

Browse Source 
* PHP-8.3:
  Fix GH-15552: Signed integer overflow in ext/standard/scanf.c
This commit is contained in:
Christoph M. Becker 2024-09-01 17:26:32 +02:00
commit c013679b70
No known key found for this signature in database
GPG Key ID: D66C9593118BCCB6
3 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@ -27,6 +27,9 @@ PHP NEWS
- PDO_Firebird:
. Fixed GH-15604 (Always make input parameters nullable). (sim1984)
- Standard:
. Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c). (cmb)
- Streams:
. Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
(cmb)

4
ext/standard/scanf.c
View File

@ -361,8 +361,7 @@ PHPAPI int ValidateFormat(char *format, int numVars, int *totalSubs)
if (gotSequential) {
goto mixedXPG;
}
objIndex = value - 1;
if ((objIndex < 0) || (numVars && (objIndex >= numVars))) {
if ((value < 1) || (numVars && (value > numVars))) {
goto badIndex;
} else if (numVars == 0) {
/*
@ -382,6 +381,7 @@ PHPAPI int ValidateFormat(char *format, int numVars, int *totalSubs)
xpgSize = (xpgSize > value) ? xpgSize : value;
}
objIndex = value - 1;
goto xpgCheckDone;
}

9
ext/standard/tests/strings/gh15552.phpt Normal file
View File

@ -0,0 +1,9 @@
--TEST--
Bug GH-15552 (Signed integer overflow in ext/standard/scanf.c)
--FILE--
<?php
var_dump(sscanf('hello','%2147483648$s'));
?>
--EXPECTF--
Fatal error: Uncaught ValueError: "%n$" argument index out of range in %s:%d
Stack trace:%A