Fixed bug #78363

nikic · nikic · commit 85e8ccd55e37 · 2019-08-02T10:35:24.000+02:00
diff --git a/NEWS b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2019, PHP 7.2.22
 
+- Core:
+  . Fixed bug #78363 (Buffer overflow in zendparse). (Nikita)
+
 - Curl:
   . Fixed bug #77946 (Bad cURL resources returned by curl_multi_info_read()).
     (Abyr Valg)
diff --git a/Zend/zend_language_parser.y b/Zend/zend_language_parser.y
@@ -1315,7 +1315,7 @@ static YYSIZE_T zend_yytnamerr(char *yyres, const char *yystr)
 
 		if (LANG_SCNG(yy_text)[0] == 0 &&
 			LANG_SCNG(yy_leng) == 1 &&
-			memcmp(yystr, "\"end of file\"", sizeof("\"end of file\"") - 1) == 0) {
+			strcmp(yystr, "\"end of file\"") == 0) {
 			if (yyres) {
 				yystpcpy(yyres, "end of file");
 			}

Original file line number	Diff line number	Diff line change
`@@ -1315,7 +1315,7 @@ static YYSIZE_T zend_yytnamerr(char yyres, const char yystr)`
`1315`	`1315`
`1316`	`1316`	`if (LANG_SCNG(yy_text)[0] == 0 &&`
`1317`	`1317`	`LANG_SCNG(yy_leng) == 1 &&`
`1318`		`- memcmp(yystr, "\"end of file\"", sizeof("\"end of file\"") - 1) == 0) {`
	`1318`	`+ strcmp(yystr, "\"end of file\"") == 0) {`
`1319`	`1319`	`if (yyres) {`
`1320`	`1320`	`yystpcpy(yyres, "end of file");`
`1321`	`1321`	`}`