Impact
The following code:
|
for (co = ZSTR_VAL(unquoted); (co = strchr(co,'\'')); qcount++, co++); |
|
|
|
quotedlen = ZSTR_LEN(unquoted) + qcount + 2; |
|
quoted_str = zend_string_alloc(quotedlen, 0); |
and the following code:
|
/* Detect quoted length, adding extra char for doubled single quotes */ |
|
for (i = 0; i < ZSTR_LEN(unquoted); i++) { |
|
if (ZSTR_VAL(unquoted)[i] == '\'') ++quotedlen; |
|
++quotedlen; |
|
} |
|
|
|
quotedlen += 2; /* +2 for opening, closing quotes */ |
|
if (use_national_character_set) { |
|
++quotedlen; /* N prefix */ |
|
} |
|
quoted_str = zend_string_alloc(quotedlen, 0); |
Can cause integer overflow, or can become a value over ZSTR_MAX_LEN causing an overflow, which eventually turns into an OOB write. This is triggerable on 32-bit especially.
Impact
The following code:
php-src/ext/pdo_firebird/firebird_driver.c
Lines 805 to 808 in 5070fbf
and the following code:
php-src/ext/pdo_dblib/dblib_driver.c
Lines 164 to 174 in c34b37f
Can cause integer overflow, or can become a value over
ZSTR_MAX_LENcausing an overflow, which eventually turns into an OOB write. This is triggerable on 32-bit especially.