php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Sec Bug #55645 buffer overflow in Split.c (test case only?)
Submitted: 2011-09-08 17:08 UTC Modified: 2011-09-15 05:07 UTC
From: thinhhq at vng dot com dot vn Assigned:
Status: Not a bug Package: Regexps related
PHP Version: 5.3.8 OS: All
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: thinhhq at vng dot com dot vn
New email:
PHP Version: OS:

 

 [2011-09-08 17:08 UTC] thinhhq at vng dot com dot vn
Description:
------------
Buffer overflow flaw found in /php-5.3.8/ext/ereg/regex/split.c

Test script:
---------------
from line 150 to line 170 
---snip snip ---

int
main(argc, argv)
int argc;
char *argv[];
{
	char buf[512];
	register int n;
#	define	MNF	10
	char *fields[MNF];

	if (argc > 4)
		for (n = atoi(argv[3]); n > 0; n--) {
			(void) strcpy(buf, argv[1]); //<--buffer overflow occurs if lenght(argv[1])>512 bytes
		}
	else if (argc > 3)
		for (n = atoi(argv[3]); n > 0; n--) {
			(void) strcpy(buf, argv[1]);//<--buffer overflow occurs if lenght(argv[1])>512 bytes
			(void) split(buf, fields, MNF, argv[2]);
		}
	else if (argc > 2)
		dosplit(argv[1], argv[2]);
---snip snip ---



Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-09-15 03:16 UTC] thinhhq at vng dot com dot vn
nothing response so far?
 [2011-09-15 05:07 UTC] rasmus@php.net
-Status: Open +Status: Bogus
 [2011-09-15 05:07 UTC] rasmus@php.net
As per the README in that directory, split.c is a standalone regression test for 
the regex library. It is not compiled into PHP and we don't even use those tests 
since we have our own separate regression testing mechanism.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue Oct 08 15:01:27 2024 UTC