FIx bug #68618 (out of bounds read crashes php-cgi)

smalyshev · smalyshev · commit f9ad3086693f · 2014-12-30T01:23:05.000-08:00
diff --git a/NEWS b/NEWS
@@ -1,6 +1,8 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 20?? PHP 5.4.37
+- CGI:
+  . Fix bug #68618 (out of bounds read crashes php-cgi). (Stas)
 
 18 Dec 2014 PHP 5.4.36
 
diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
@@ -2429,14 +2429,17 @@ consult the installation file that came with this distribution, or visit \n\
 						    int i = 1;
 
 						    c = file_handle.handle.stream.mmap.buf[i++];
-							while (c != '\n' && c != '\r' && c != EOF) {
+							while (c != '\n' && c != '\r' && i < file_handle.handle.stream.mmap.len) {
 								c = file_handle.handle.stream.mmap.buf[i++];
 							}
 							if (c == '\r') {
-								if (file_handle.handle.stream.mmap.buf[i] == '\n') {
+								if (i < file_handle.handle.stream.mmap.len && file_handle.handle.stream.mmap.buf[i] == '\n') {
 									i++;
 								}
 							}
+							if(i > file_handle.handle.stream.mmap.len) {
+								i = file_handle.handle.stream.mmap.len;
+							}
 							file_handle.handle.stream.mmap.buf += i;
 							file_handle.handle.stream.mmap.len -= i;
 						}

Original file line number	Diff line number	Diff line change
`@@ -2429,14 +2429,17 @@ consult the installation file that came with this distribution, or visit \n\`
`2429`	`2429`	`int i = 1;`
`2430`	`2430`
`2431`	`2431`	`c = file_handle.handle.stream.mmap.buf[i++];`
`2432`		`- while (c != '\n' && c != '\r' && c != EOF) {`
	`2432`	`+ while (c != '\n' && c != '\r' && i < file_handle.handle.stream.mmap.len) {`
`2433`	`2433`	`c = file_handle.handle.stream.mmap.buf[i++];`
`2434`	`2434`	`}`
`2435`	`2435`	`if (c == '\r') {`
`2436`		`- if (file_handle.handle.stream.mmap.buf[i] == '\n') {`
	`2436`	`+ if (i < file_handle.handle.stream.mmap.len && file_handle.handle.stream.mmap.buf[i] == '\n') {`
`2437`	`2437`	`i++;`
`2438`	`2438`	`}`
`2439`	`2439`	`}`
	`2440`	`+ if(i > file_handle.handle.stream.mmap.len) {`
	`2441`	`+ i = file_handle.handle.stream.mmap.len;`
	`2442`	`+ }`
`2440`	`2443`	`file_handle.handle.stream.mmap.buf += i;`
`2441`	`2444`	`file_handle.handle.stream.mmap.len -= i;`
`2442`	`2445`	`}`