mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-24 18:34:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix #79371: mb_strtolower (UTF-32LE): stack-buffer-overflow

Browse Source 
We make sure that negative values are properly compared.
This commit is contained in:
Christoph M. Becker 2020-03-12 13:04:04 +01:00 committed by Stanislav Malyshev
parent a57905dbac
commit db848e1482
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ext/mbstring/php_unicode.c
View File

@ -315,7 +315,7 @@ static int convert_case_filter(int c, void *void_data)
/* Handle invalid characters early, as we assign special meaning to
* codepoints above 0xffffff. */
if (UNEXPECTED(c > 0xffffff)) {
if (UNEXPECTED((unsigned) c > 0xffffff)) {
(*data->next_filter->filter_function)(c, data->next_filter);
return 0;
}

14
ext/mbstring/tests/bug79371.phpt Normal file
View File

@ -0,0 +1,14 @@
--TEST--
Bug #79371 (mb_strtolower (UTF-32LE): stack-buffer-overflow)
--SKIPIF--
<?php
if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
?>
--FILE--
<?php
$bytes = array(0xef, 0xbf, 0xbd, 0xef);
$str = implode(array_map("chr", $bytes));
var_dump(bin2hex(mb_strtolower($str, "UTF-32LE")));
?>
--EXPECT--
string(8) "3f000000"