disallow negative length

This commit is contained in:
Stanislav Malyshev 2007-02-24 01:18:14 +00:00
parent c3935671cd
commit 3e262bd369

View File

@ -478,7 +478,7 @@ PS_SERIALIZER_DECODE_FUNC(php_binary)
zval **tmp;
namelen = *p & (~PS_BIN_UNDEF);
if (namelen > PS_BIN_MAX || (p + namelen) >= endptr) {
if (namelen < 0 || namelen > PS_BIN_MAX || (p + namelen) >= endptr) {
return FAILURE;
}