php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #8498 Crash due to buffer overflow - suggested patch inside
Submitted: 2000-12-31 07:35 UTC Modified: 2001-01-02 15:27 UTC
From: johan at ekenberg dot se Assigned:
Status: Closed Package: Date/time related
PHP Version: 4.0.4 OS: Linux 2.2.16
Private report: No CVE-ID: None
 [2000-12-31 07:35 UTC] johan at ekenberg dot se
date("r") prints current time in rfc822 format = 31 characters.
In "ext/standard/datetime.c" (line 491) these 31 chars are copied into a buffer
(tmp_buff) that is only 16 chars long.
On my machine this has caused segmentation faults on various occations.

Suggested patch:

--- datetime.c  Sun Dec 31 13:06:48 2000
+++ datetime_fixed.c    Sun Dec 31 13:04:41 2000
@@ -214,7 +214,7 @@
        time_t the_time;
        struct tm *ta, tmbuf;
        int i, size = 0, length, h, beat;
-       char tmp_buff[16];
+       char tmp_buff[32];

        switch(ZEND_NUM_ARGS()) {
        case 1:

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-01-02 15:27 UTC] rasmus@php.net
Fixed - thanks
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Sun Nov 19 01:31:42 2017 UTC