php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #8498 Crash due to buffer overflow - suggested patch inside
Submitted: 2000-12-31 07:35 UTC Modified: 2001-01-02 15:27 UTC
From: johan at ekenberg dot se Assigned:
Status: Closed Package: Date/time related
PHP Version: 4.0.4 OS: Linux 2.2.16
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please !
Your email address:
MUST BE VALID
Solve the problem:
12 + 34 = ?
Subscribe to this entry?

 
 [2000-12-31 07:35 UTC] johan at ekenberg dot se 
date("r") prints current time in rfc822 format = 31 characters.
In "ext/standard/datetime.c" (line 491) these 31 chars are copied into a buffer
(tmp_buff) that is only 16 chars long.
On my machine this has caused segmentation faults on various occations.

Suggested patch:

--- datetime.c  Sun Dec 31 13:06:48 2000
+++ datetime_fixed.c    Sun Dec 31 13:04:41 2000
@@ -214,7 +214,7 @@
        time_t the_time;
        struct tm *ta, tmbuf;
        int i, size = 0, length, h, beat;
-       char tmp_buff[16];
+       char tmp_buff[32];

        switch(ZEND_NUM_ARGS()) {
        case 1:

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-01-02 15:27 UTC] rasmus@php.net 
Fixed - thanks
 
PHP Copyright © 2001-2023 The PHP Group
All rights reserved. 		Last updated: Sun May 28 23:03:39 2023 UTC