File: CVE-2011-1471.patch

package info (click to toggle)
php5 5.3.3.1-7%2Bsqueeze29
  • links: PTS, VCS
  • area: main
  • in suites: squeeze-lts
  • size: 123,520 kB
  • ctags: 55,742
  • sloc: ansic: 633,963; php: 19,620; sh: 11,344; xml: 5,816; cpp: 2,400; yacc: 1,745; exp: 1,514; makefile: 1,019; pascal: 623; awk: 537; sql: 22
file content (34 lines) | stat: -rw-r--r-- 975 bytes parent folder | download | duplicates (3)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
--- a/ext/zip/zip_stream.c
+++ b/ext/zip/zip_stream.c
@@ -30,11 +30,11 @@ struct php_zip_stream_data_t {
 /* {{{ php_zip_ops_read */
 static size_t php_zip_ops_read(php_stream *stream, char *buf, size_t count TSRMLS_DC)
 {
-	int n = 0;
+	ssize_t n = 0;
 	STREAM_DATA_FROM_STREAM();
 
 	if (self->za && self->zf) {
-		n = (size_t)zip_fread(self->zf, buf, (int)count);
+		n = zip_fread(self->zf, buf, count);
 		if (n < 0) {
 			int ze, se;
 			zip_file_error_get(self->zf, &ze, &se);
@@ -42,13 +42,15 @@ static size_t php_zip_ops_read(php_strea
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Zip stream error: %s", zip_file_strerror(self->zf));
 			return 0;
 		}
-		if (n == 0 || n < count) {
+		/* cast count to signed value to avoid possibly negative n
+		 * being cast to unsigned value */
+		if (n == 0 || n < (ssize_t)count) {
 			stream->eof = 1;
 		} else {
 			self->cursor += n;
 		}
 	}
-	return (n < 1 ? 0 : n);
+	return (n < 1 ? 0 : (size_t)n);
 }
 /* }}} */