24 lines
973 B
Diff
24 lines
973 B
Diff
X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fereg%2Fregex%2Fregcomp.c;h=f4bfc1c1679ffedfff020a7c1c73811075cb7710;hp=156eee93292a2c0cd7c4514250a5c07cc8f99fcc;hb=5fd617f2f5afa3a687969e7844864e027f97d964;hpb=7f183044fd301ed75f37983b95903b71467c29f4
|
|
|
|
diff --git a/ext/ereg/regex/regcomp.c b/ext/ereg/regex/regcomp.c
|
|
index 156eee9..f4bfc1c 100644
|
|
--- a/ext/ereg/regex/regcomp.c
|
|
+++ b/ext/ereg/regex/regcomp.c
|
|
@@ -117,7 +117,15 @@ int cflags;
|
|
(NC-1)*sizeof(cat_t));
|
|
if (g == NULL)
|
|
return(REG_ESPACE);
|
|
- p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
|
|
+ {
|
|
+ /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */
|
|
+ size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
|
|
+ if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) {
|
|
+ free((char *) g);
|
|
+ return REG_INVARG;
|
|
+ }
|
|
+ p->ssize = new_ssize;
|
|
+ }
|
|
p->strip = (sop *)malloc(p->ssize * sizeof(sop));
|
|
p->slen = 0;
|
|
if (p->strip == NULL) {
|
