X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fereg%2Fregex%2Fregcomp.c;h=f4bfc1c1679ffedfff020a7c1c73811075cb7710;hp=156eee93292a2c0cd7c4514250a5c07cc8f99fcc;hb=5fd617f2f5afa3a687969e7844864e027f97d964;hpb=7f183044fd301ed75f37983b95903b71467c29f4

diff --git a/ext/ereg/regex/regcomp.c b/ext/ereg/regex/regcomp.c
index 156eee9..f4bfc1c 100644
--- a/ext/ereg/regex/regcomp.c
+++ b/ext/ereg/regex/regcomp.c
@@ -117,7 +117,15 @@ int cflags;
 							(NC-1)*sizeof(cat_t));
 	if (g == NULL)
 		return(REG_ESPACE);
-	p->ssize = len/(size_t)2*(size_t)3 + (size_t)1;	/* ugh */
+	{
+		/* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */
+		size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
+		if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) {
+			free((char *) g);
+			return REG_INVARG;
+		}
+		p->ssize = new_ssize;
+	}
 	p->strip = (sop *)malloc(p->ssize * sizeof(sop));
 	p->slen = 0;
 	if (p->strip == NULL) {