Skip to content

Commit fce3d4f

Browse files
committed
Fix oss-fuzz report triggered by GH-15712 commit.
It triggered allocation overflow which, even fixed, in turn gives memory leak on 32 bits but the allocator relies on signed integers so instead of changing `j` type we exit if an overflow during the buffer increase is going to happen.
1 parent b26e610 commit fce3d4f

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

Zend/zend_strtod.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3613,11 +3613,11 @@ rv_alloc(i) int i;
36133613
rv_alloc(int i)
36143614
#endif
36153615
{
3616-
int k, *r;
3616+
int j, k, *r;
36173617

3618-
size_t j = sizeof(ULong);
3618+
j = sizeof(ULong);
36193619
for(k = 0;
3620-
sizeof(Bigint) - sizeof(ULong) - sizeof(int) + j <= (size_t)i;
3620+
j <= (INT_MAX >> 1) && sizeof(Bigint) - sizeof(ULong) - sizeof(int) + j <= (size_t)i;
36213621
j <<= 1)
36223622
k++;
36233623
r = (int*)Balloc(k);

0 commit comments

Comments
 (0)