mirror of
https://github.com/php/php-src.git
synced 2024-11-27 11:53:33 +08:00
disallow negative length
This commit is contained in:
parent
c3935671cd
commit
3e262bd369
@ -478,7 +478,7 @@ PS_SERIALIZER_DECODE_FUNC(php_binary)
|
||||
zval **tmp;
|
||||
namelen = *p & (~PS_BIN_UNDEF);
|
||||
|
||||
if (namelen > PS_BIN_MAX || (p + namelen) >= endptr) {
|
||||
if (namelen < 0 || namelen > PS_BIN_MAX || (p + namelen) >= endptr) {
|
||||
return FAILURE;
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user