summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStanislav Malyshev <stas@php.net>2012-06-08 06:09:37 (GMT)
committerStanislav Malyshev <stas@php.net>2012-06-08 06:09:37 (GMT)
commit426ccd3e7f9aabc5d4e3b97a51d2c19ba44871d5 (patch)
tree553e0fa6bf7eecb54d64dcdd627ea4694118a1d2
parent730493f2bb23b60f4fe895e3e0dd04eff904417c (diff)
parent10e8da1738dc5331c595524837e69fd17ad9236a (diff)
downloadphp-426ccd3e7f9aabc5d4e3b97a51d2c19ba44871d5.tar.gz
Merge branch 'PHP-5.4'
* PHP-5.4: fix potential overflow in _php_stream_scandir
-rwxr-xr-xmain/streams/streams.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/main/streams/streams.c b/main/streams/streams.c
index 3f868b2..1945724 100755
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -2263,8 +2263,8 @@ PHPAPI int _php_stream_scandir(char *dirname, char **namelist[], int flags, php_
php_stream *stream;
php_stream_dirent sdp;
char **vector = NULL;
- int vector_size = 0;
- int nfiles = 0;
+ unsigned int vector_size = 0;
+ unsigned int nfiles = 0;
if (!namelist) {
return FAILURE;
@@ -2282,12 +2282,17 @@ PHPAPI int _php_stream_scandir(char *dirname, char **namelist[], int flags, php_
} else {
vector_size *= 2;
}
- vector = (char **) erealloc(vector, vector_size * sizeof(char *));
+ vector = (char **) safe_erealloc(vector, vector_size, sizeof(char *), 0);
}
vector[nfiles] = estrdup(sdp.d_name);
nfiles++;
+ if(vector_size < 10 || nfiles == 0) {
+ /* overflow */
+ efree(vector);
+ return FAILURE;
+ }
}
php_stream_closedir(stream);