Skip to content

Commit 383a9f4

Browse files
committed
Merge branch 'PHP-7.4'
* PHP-7.4: Fix #74267: segfault with streams and invalid data
2 parents 83a7701 + ee4683c commit 383a9f4

File tree

2 files changed

+29
-4
lines changed

2 files changed

+29
-4
lines changed

ext/standard/filters.c

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -663,7 +663,7 @@ static php_conv_err_t php_conv_qprint_encode_convert(php_conv_qprint_encode *ins
663663
lb_ptr = inst->lb_ptr;
664664
lb_cnt = inst->lb_cnt;
665665

666-
if ((in_pp == NULL || in_left_p == NULL) && (lb_ptr >=lb_cnt)) {
666+
if (in_pp == NULL || in_left_p == NULL) {
667667
return PHP_CONV_ERR_SUCCESS;
668668
}
669669

@@ -891,7 +891,7 @@ static php_conv_err_t php_conv_qprint_decode_convert(php_conv_qprint_decode *ins
891891
lb_ptr = inst->lb_ptr;
892892
lb_cnt = inst->lb_cnt;
893893

894-
if ((in_pp == NULL || in_left_p == NULL) && lb_cnt == lb_ptr) {
894+
if (in_pp == NULL || in_left_p == NULL) {
895895
if (inst->scan_stat != 0) {
896896
return PHP_CONV_ERR_UNEXPECTED_EOS;
897897
}
@@ -988,8 +988,7 @@ static php_conv_err_t php_conv_qprint_decode_convert(php_conv_qprint_decode *ins
988988
*ps == (unsigned char)inst->lbchars[lb_cnt]) {
989989
lb_cnt++;
990990
scan_stat = 5;
991-
}
992-
if (*ps != '\t' && *ps != ' ') {
991+
} else if (*ps != '\t' && *ps != ' ') {
993992
err = PHP_CONV_ERR_INVALID_SEQ;
994993
goto out;
995994
}
Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
--TEST--
2+
Bug #74267 (segfault with streams and invalid data)
3+
--FILE--
4+
<?php
5+
$stream = fopen('php://memory', 'w');
6+
stream_filter_append($stream, 'convert.quoted-printable-decode', STREAM_FILTER_WRITE, ['line-break-chars' => "\r\n"]);
7+
8+
$lines = [
9+
"\r\n",
10+
" -=()\r\n",
11+
" -=\r\n",
12+
"\r\n"
13+
];
14+
15+
foreach ($lines as $line) {
16+
fwrite($stream, $line);
17+
}
18+
19+
fclose($stream);
20+
echo "done\n";
21+
?>
22+
--EXPECTF--
23+
Warning: fwrite(): stream filter (convert.quoted-printable-decode): invalid byte sequence in %s on line %d
24+
25+
Warning: fwrite(): stream filter (convert.quoted-printable-decode): invalid byte sequence in %s on line %d
26+
done

0 commit comments

Comments
 (0)