Merge branch 'PHP-5.6'

smalyshev · smalyshev · commit 16b904cc1cf4 · 2014-12-30T01:27:20.000-08:00
* PHP-5.6:
  FIx bug #68618 (out of bounds read crashes php-cgi)
  Fixed bug #68676 (Explicit Double Free)
  Fixed bug #68676 (Explicit Double Free)
diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
@@ -2414,14 +2414,17 @@ consult the installation file that came with this distribution, or visit \n\
 						    int i = 1;
 
 						    c = file_handle.handle.stream.mmap.buf[i++];
-							while (c != '\n' && c != '\r' && c != EOF) {
+							while (c != '\n' && c != '\r' && i < file_handle.handle.stream.mmap.len) {
 								c = file_handle.handle.stream.mmap.buf[i++];
 							}
 							if (c == '\r') {
-								if (file_handle.handle.stream.mmap.buf[i] == '\n') {
+								if (i < file_handle.handle.stream.mmap.len && file_handle.handle.stream.mmap.buf[i] == '\n') {
 									i++;
 								}
 							}
+							if(i > file_handle.handle.stream.mmap.len) {
+								i = file_handle.handle.stream.mmap.len;
+							}
 							file_handle.handle.stream.mmap.buf += i;
 							file_handle.handle.stream.mmap.len -= i;
 						}

Original file line number	Diff line number	Diff line change
`@@ -2414,14 +2414,17 @@ consult the installation file that came with this distribution, or visit \n\`
`2414`	`2414`	`int i = 1;`
`2415`	`2415`
`2416`	`2416`	`c = file_handle.handle.stream.mmap.buf[i++];`
`2417`		`- while (c != '\n' && c != '\r' && c != EOF) {`
	`2417`	`+ while (c != '\n' && c != '\r' && i < file_handle.handle.stream.mmap.len) {`
`2418`	`2418`	`c = file_handle.handle.stream.mmap.buf[i++];`
`2419`	`2419`	`}`
`2420`	`2420`	`if (c == '\r') {`
`2421`		`- if (file_handle.handle.stream.mmap.buf[i] == '\n') {`
	`2421`	`+ if (i < file_handle.handle.stream.mmap.len && file_handle.handle.stream.mmap.buf[i] == '\n') {`
`2422`	`2422`	`i++;`
`2423`	`2423`	`}`
`2424`	`2424`	`}`
	`2425`	`+ if(i > file_handle.handle.stream.mmap.len) {`
	`2426`	`+ i = file_handle.handle.stream.mmap.len;`
	`2427`	`+ }`
`2425`	`2428`	`file_handle.handle.stream.mmap.buf += i;`
`2426`	`2429`	`file_handle.handle.stream.mmap.len -= i;`
`2427`	`2430`	`}`