Skip to content

Commit 5589bf4

Browse files
committed
Fix length inconsistency in mb_convert_encoding
Don't mix strlen() and ZSTR_LEN(). If the encoding contains a NULL byte, this will overflow the buffer. NULL bytes will still make this behave oddly because the consuming code will cut off the string there, but let's address that in master...
1 parent 91f8787 commit 5589bf4

File tree

2 files changed

+5
-1
lines changed

2 files changed

+5
-1
lines changed

ext/mbstring/mbstring.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3370,7 +3370,7 @@ PHP_FUNCTION(mb_convert_encoding)
33703370

33713371
if ( _from_encodings) {
33723372
l = strlen(_from_encodings);
3373-
n = strlen(ZSTR_VAL(encoding_str));
3373+
n = ZSTR_LEN(encoding_str);
33743374
_from_encodings = erealloc(_from_encodings, l+n+2);
33753375
memcpy(_from_encodings + l, ",", 1);
33763376
memcpy(_from_encodings + l + 1, ZSTR_VAL(encoding_str), ZSTR_LEN(encoding_str) + 1);

ext/mbstring/tests/bug79149.phpt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
88
<?php
99
var_dump(mb_convert_encoding("", "UTF-8", [0]));
1010
var_dump(mb_convert_encoding('foo', 'UTF-8', array(['bar'], ['baz'])));
11+
var_dump(mb_convert_encoding('foo', 'UTF-8', array("foo\0bar")));
1112
?>
1213
--EXPECTF--
1314
Warning: mb_convert_encoding(): Illegal character encoding specified in %s on line %d
@@ -19,3 +20,6 @@ Notice: Array to string conversion in %s on line %d
1920

2021
Warning: mb_convert_encoding(): Illegal character encoding specified in %s on line %d
2122
string(3) "foo"
23+
24+
Warning: mb_convert_encoding(): Illegal character encoding specified in %s on line %d
25+
string(3) "foo"

0 commit comments

Comments
 (0)