File: CVE-2011-0420.patch

package info (click to toggle)
php5 5.3.3-7%2Bsqueeze19
  • links: PTS, VCS
  • area: main
  • in suites: squeeze
  • size: 122,836 kB
  • ctags: 55,742
  • sloc: ansic: 633,963; php: 19,620; sh: 11,344; xml: 5,816; cpp: 2,400; yacc: 1,745; exp: 1,514; makefile: 1,019; pascal: 623; awk: 537; sql: 22
file content (31 lines) | stat: -rw-r--r-- 1,061 bytes parent folder | download | duplicates (3)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
--- a/ext/intl/grapheme/grapheme_string.c
+++ b/ext/intl/grapheme/grapheme_string.c
@@ -799,7 +799,7 @@ PHP_FUNCTION(grapheme_extract)
 
 	if ( NULL != next ) {
 		if ( !PZVAL_IS_REF(next) ) {
-			intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,
+			intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, 
 				 "grapheme_extract: 'next' was not passed by reference", 0 TSRMLS_CC );
 			 
 			RETURN_FALSE;
@@ -819,11 +819,17 @@ PHP_FUNCTION(grapheme_extract)
 	}
 
 	if ( lstart > INT32_MAX || lstart < 0 || lstart >= str_len ) {
+		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "grapheme_extract: start not contained in string", 0 TSRMLS_CC );
+		RETURN_FALSE;
+	}
 
-		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "grapheme_extract: start not contained in string", 1 TSRMLS_CC );
-
+	if ( size > INT32_MAX || size < 0) {
+		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "grapheme_extract: size is invalid", 0 TSRMLS_CC );
 		RETURN_FALSE;
 	}
+	if (size == 0) {
+		RETURN_EMPTY_STRING();
+	}
 
 	/* we checked that it will fit: */
 	start = (int32_t) lstart;