mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-24 10:24:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-5.5' into PHP-5.6

Browse Source 
* PHP-5.5:
  FIx bug #68618 (out of bounds read crashes php-cgi)
  Fixed bug #68676 (Explicit Double Free)
This commit is contained in:
Stanislav Malyshev 2014-12-30 01:26:18 -08:00
commit 4c0f17caca
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@ -17,6 +17,9 @@
constructor). (dunglas at gmail dot com)
. Fixed bug #68676 (Explicit Double Free). (Kalle)
- CGI:
. Fix bug #68618 (out of bounds read crashes php-cgi). (Stas)
- cURL:
. Fixed bug #67643 (curl_multi_getcontent returns '' when
CURLOPT_RETURNTRANSFER isn't set). (Jille Timmermans)

7
sapi/cgi/cgi_main.c
View File

@ -2437,14 +2437,17 @@ consult the installation file that came with this distribution, or visit \n\
int i = 1;
c = file_handle.handle.stream.mmap.buf[i++];
while (c != '\n' && c != '\r' && c != EOF) {
while (c != '\n' && c != '\r' && i < file_handle.handle.stream.mmap.len) {
c = file_handle.handle.stream.mmap.buf[i++];
}
if (c == '\r') {
if (file_handle.handle.stream.mmap.buf[i] == '\n') {
if (i < file_handle.handle.stream.mmap.len && file_handle.handle.stream.mmap.buf[i] == '\n') {
i++;
}
}
if(i > file_handle.handle.stream.mmap.len) {
i = file_handle.handle.stream.mmap.len;
}
file_handle.handle.stream.mmap.buf += i;
file_handle.handle.stream.mmap.len -= i;
}