Here's the patch. I'm going to commit this soon.
Moriyoshi
Index: Zend/zend_alloc.c
===================================================================
RCS file: /repository/ZendEngine2/zend_alloc.c,v
retrieving revision 1.138
diff -u -r1.138 zend_alloc.c
--- Zend/zend_alloc.c 15 Jul 2004 22:59:54 -0000 1.138
+++ Zend/zend_alloc.c 20 Jul 2004 20:24:40 -0000
@@ -241,6 +241,30 @@
return 0;
}
+ZEND_API void *_safe_p_malloc(size_t nmemb, size_t size, size_t offset)
+{
+
+ if (nmemb < LONG_MAX
+ && size < LONG_MAX
+ && offset < LONG_MAX
+ && nmemb >= 0
+ && size >= 0
+ && offset >= 0) {
+ long lval;
+ double dval;
+ int use_dval;
+
+ ZEND_SIGNED_MULTIPLY_LONG(nmemb, size, lval, dval,
use_dval);
+
+ if (!use_dval
+ && lval < (long) (LONG_MAX - offset)) {
+ return pemalloc(lval + offset, 1);
+ }
+ }
+
+ zend_error(E_ERROR, "Possible integer overflow in memory
allocation (%zd * %zd + %zd)", nmemb, size, offset);
+ return 0;
+}
ZEND_API void _efree(void *ptr ZEND_FILE_LINE_DC
ZEND_FILE_LINE_ORIG_DC)
Index: Zend/zend_alloc.h
===================================================================
RCS file: /repository/ZendEngine2/zend_alloc.h,v
retrieving revision 1.54
diff -u -r1.54 zend_alloc.h
--- Zend/zend_alloc.h 19 Jul 2004 07:19:01 -0000 1.54
+++ Zend/zend_alloc.h 20 Jul 2004 20:24:40 -0000
@@ -78,6 +78,7 @@
ZEND_API void *_emalloc(size_t size ZEND_FILE_LINE_DC
ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
ZEND_API void *_safe_emalloc(size_t nmemb, size_t size, size_t offset
ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
+ZEND_API void *_safe_p_malloc(size_t nmemb, size_t size, size_t
offset) ZEND_ATTRIBUTE_MALLOC;
ZEND_API void _efree(void *ptr ZEND_FILE_LINE_DC
ZEND_FILE_LINE_ORIG_DC);
ZEND_API void *_ecalloc(size_t nmemb, size_t size ZEND_FILE_LINE_DC
ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
ZEND_API void *_erealloc(void *ptr, size_t size, int allow_failure
ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
@@ -106,6 +107,7 @@
/* Selective persistent/non persistent allocation macros */
#define pemalloc(size, persistent)
((persistent)?malloc(size):emalloc(size))
+#define safe_pemalloc(nmemb, size, offset, persistent)
((persistent)?_safe_p_malloc(nmemb, size, offset):safe_emalloc(nmemb,
size, offset))
#define pefree(ptr, persistent) ((persistent)?free(ptr):efree(ptr))
#define pecalloc(nmemb, size, persistent)
((persistent)?calloc((nmemb), (size)):ecalloc((nmemb), (size)))
#define perealloc(ptr, size, persistent) ((persistent)?realloc((ptr),
(size)):erealloc((ptr), (size)))
On 2004/07/21, at 0:57, Zeev Suraski wrote:
