author | Craig Mohrman <craig.mohrman@oracle.com> |
Thu, 23 Apr 2015 12:34:24 -0700 | |
branch | s11-update |
changeset 4179 | d3168ead33bd |
parent 2923 | d19580922ffe |
permissions | -rw-r--r-- |
2923
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
1 |
From |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
2 |
http://git.php.net/?p=php-src.git;a=commitdiff;h=4828f7343b3f31d914f4d4a5545865b8a19f7fb6 |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
3 |
Integer overflow in SndToJewish leads to php hang |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
4 |
and |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
5 |
http://git.php.net/?p=php-src.git;a=commitdiff;h=c50cef1dc54ffd1d0fb71d1afb8b2c3cb3c5b6ef |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
6 |
Fixed bug #64895 Integer overflow in SndToJewish |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
7 |
|
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
8 |
CVE-2013-2110 - use correct formula to calculate string size |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
9 |
does NOT apply because no such function to patch. |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
10 |
|
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
11 |
--- php-5.2.17/ext/calendar/jewish.c_orig 2003-03-22 17:44:58.000000000 -0800 |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
12 |
+++ php-5.2.17/ext/calendar/jewish.c 2013-07-01 15:33:18.280118195 -0700 |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
13 |
@@ -272,6 +272,7 @@ |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
14 |
#define HALAKIM_PER_METONIC_CYCLE (HALAKIM_PER_LUNAR_CYCLE * (12 * 19 + 7)) |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
15 |
|
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
16 |
#define JEWISH_SDN_OFFSET 347997 |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
17 |
+#define JEWISH_SDN_MAX 324542846L /* 12/13/887605, greater value raises interger overflow */ |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
18 |
#define NEW_MOON_OF_CREATION 31524 |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
19 |
|
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
20 |
#define SUNDAY 0 |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
21 |
@@ -519,7 +520,7 @@ |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
22 |
int tishri1After; |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
23 |
int yearLength; |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
24 |
|
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
25 |
- if (sdn <= JEWISH_SDN_OFFSET) { |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
26 |
+ if (sdn <= JEWISH_SDN_OFFSET || sdn > JEWISH_SDN_MAX) { |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
27 |
*pYear = 0; |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
28 |
*pMonth = 0; |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
29 |
*pDay = 0; |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
30 |
|
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
31 |
|
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
32 |
--- php-5.2.17/ext/calendar/tests/jdtojewish64.phpt_orig 2013-07-01 15:41:34.918645609 -0700 |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
33 |
+++ php-5.2.17/ext/calendar/tests/jdtojewish64.phpt 2013-07-01 15:37:34.054921308 -0700 |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
34 |
@@ -0,0 +1,19 @@ |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
35 |
+--TEST-- |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
36 |
+Bug #64895: Integer overflow in SndToJewish |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
37 |
+--SKIPIF-- |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
38 |
+<?php |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
39 |
+include 'skipif.inc'; |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
40 |
+if (PHP_INT_SIZE == 4) { |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
41 |
+ die("skip this test is for 64bit platform only"); |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
42 |
+} |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
43 |
+?> |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
44 |
+--FILE-- |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
45 |
+<?php |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
46 |
+$a = array(38245310, 324542846, 324542847, 9223372036854743639); |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
47 |
+ |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
48 |
+foreach ($a as $x) var_dump(jdtojewish($x)); |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
49 |
+--EXPECTF-- |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
50 |
+string(11) "2/22/103759" |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
51 |
+string(12) "12/13/887605" |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
52 |
+string(5) "0/0/0" |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
53 |
+string(5) "0/0/0" |
d19580922ffe
16658678 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
54 |