mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-12-18 14:30:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix recovery of large entities in mb_decode_numericentity()

Browse Source 
Make sure we don't overflow the integer.
This commit is contained in:
Nikita Popov 2020-01-29 11:44:56 +01:00
parent 5265fabc25
commit 91f878779c
2 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ext/mbstring/libmbfl/mbfl/mbfilter.c
View File

@ -2586,12 +2586,10 @@ collector_decode_htmlnumericentity(int c, void *data)
(*pc->decoder->filter_function)(0x23, pc->decoder); /* '#' */
r = 1;
n = pc->digit;
while (n > 0) {
while (n > 1) {
r *= 10;
n--;
}
s %= r;
r /= 10;
while (r > 0) {
d = s/r;
s %= r;
@ -2764,12 +2762,10 @@ int mbfl_filt_decode_htmlnumericentity_flush(mbfl_convert_filter *filter)
s = pc->cache;
r = 1;
n = pc->digit;
while (n > 0) {
while (n > 1) {
r *= 10;
n--;
}
s %= r;
r /= 10;
while (r > 0) {
d = s/r;
s %= r;

8
ext/mbstring/tests/mb_decode_numericentity.phpt
View File

@ -14,8 +14,16 @@ $convmap = array(0x0, 0x2FFFF, 0, 0xFFFF);
echo mb_decode_numericentity($str1, $convmap, "UTF-8")."\n";
echo mb_decode_numericentity($str2, $convmap, "UTF-8")."\n";
echo mb_decode_numericentity($str3, $convmap, "UTF-8")."\n";
echo mb_decode_numericentity('&#1000000000', $convmap), "\n";
echo mb_decode_numericentity('&#10000000000', $convmap), "\n";
echo mb_decode_numericentity('&#100000000000', $convmap), "\n";
?>
--EXPECT--
¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ
ƒΑΒΓΔΕΖΗΘΙΚΛΜΝΞΟΠΡΣΤΥΦΧΨΩαβγδεζηθικλμνξοπρςστυφχψωϑϒϖ•…′″‾⁄℘ℑℜ™ℵ←↑→↓↔↵⇐⇑⇒⇓⇔∀∂∃∅∇∈∉∋∏∑−∗√∝∞∠∧∨∩∪∫∴∼≅≈≠≡≤≥⊂⊃⊄⊆⊇⊕⊗⊥⋅⌈⌉⌊⌋〈〉◊♠♣♥♦
aŒbœcŠdše€fg
&#1000000000
&#10000000000
&#100000000000