|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2016-06-14 12:24 UTC] taoguangchen at icloud dot com
Description:
------------
Some PHP5 functions can create strings with negative value lengths
rawurlencode
```
<?php
ini_set('memory_limit', -1);
$str = str_repeat("&", 0xffffffff/3);
$str = rawurlencode($str);
var_dump(strlen($str));
?>
```
bin2hex
```
<?php
ini_set('memory_limit', -1);
$str = str_repeat("A", 0xffffffff/4+1);
$str = bin2hex($str);
var_dump(strlen($str));
?>
```
implode (fixed in bug#72275)
```
<?php
ini_set('memory_limit', -1);
$str = str_repeat("A", 0xffffffff/4);
$arr = [$str, $str, $str, $str];
$str = implode($arr);
var_dump(strlen($str));
?>
```
quotemeta
```
<?php
ini_set('memory_limit', -1);
$str = str_repeat("$", 0xffffffff/4+1);
$str = quotemeta($str);
var_dump(strlen($str));
?>
```
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Wed Oct 29 00:00:01 2025 UTC |
I guess the fix in PHP_FUNCTION(nl2br) is incorrect: int new_length; [...] if (UNEXPECTED(new_length > INT_MAX)) { [...] This check will never trigger (since new_length is an int, obviously). You should also check str_len + 1 for an overflow against INT_MAX, since this variable may possibly also overflow when issuing the memory allocation: int str_len; [...] tmp = target = safe_emalloc(repl_cnt, repl_len, str_len + 1); [...]