php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #73391 Writing of floats can cause OOB reads
Submitted: 2016-10-26 13:56 UTC Modified: 2016-10-26 14:49 UTC
From: cmb@php.net Assigned: cmb (profile)
Status: Closed Package: dbase (PECL)
PHP Version: 5.6.27 OS: *
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: cmb@php.net
New email:
PHP Version: OS:

 

 [2016-10-26 13:56 UTC] cmb@php.net
Description:
------------
The fix for bug #39305 introduced a potential OOB read, which
happens when floats are written whose string representation is
shorter than the specified field lenght.


Test script:
---------------
<?php

$db = dbase_create(
    __DIR__ . DIRECTORY_SEPARATOR . 'dbase-float.dbf',
    array(
        array('num', 'N', 10, 2)
    )
);

dbase_add_record($db, array(1.23));

dbase_close($db);


Expected result:
----------------
valgrind doesn't report any issues

Actual result:
--------------
valgrind reports invalid reads

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-10-26 13:56 UTC] cmb@php.net
-Assigned To: +Assigned To: cmb
 [2016-10-26 14:09 UTC] cmb@php.net
Automatic comment from SVN on behalf of cmb
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=340713
Log: Fix #73391: Writing of floats can cause OOB reads

Floats whose string representation is shorter than the specified field
length have to be filled with leading spaces.
 [2016-10-26 14:48 UTC] cmb@php.net
Automatic comment from SVN on behalf of cmb
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=340714
Log: Merged revision(s) 340713 from pecl/dbase/branches/dbase-5.1:
Fix #73391: Writing of floats can cause OOB reads

Floats whose string representation is shorter than the specified field
length have to be filled with leading spaces.
........
 [2016-10-26 14:49 UTC] cmb@php.net
-Status: Assigned +Status: Closed
 
PHP Copyright © 2001-2020 The PHP Group
All rights reserved.
Last updated: Mon Mar 30 23:01:24 2020 UTC