[packages/php.git] / php-5.2.17-CVE-2011-1092.patch

--- PHP_5_3/ext/shmop/shmop.c	2011/01/01 02:19:59	306939
+++ PHP_5_3/ext/shmop/shmop.c	2011/03/08 13:11:14	309018
@@ -256,7 +256,7 @@
 		RETURN_FALSE;
 	}
 
-	if (start + count > shmop->size || count < 0) {
+	if (count < 0 || start > (INT_MAX - count) || start + count > shmop->size) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "count is out of range");
 		RETURN_FALSE;
 	}
Commit	Line	Data
fb98beff ER	1	--- PHP_5_3/ext/shmop/shmop.c 2011/01/01 02:19:59 306939
	2	+++ PHP_5_3/ext/shmop/shmop.c 2011/03/08 13:11:14 309018
	3	@@ -256,7 +256,7 @@
	4	RETURN_FALSE;
	5	}
	6
	7	- if (start + count > shmop->size \|\| count < 0) {
	8	+ if (count < 0 \|\| start > (INT_MAX - count) \|\| start + count > shmop->size) {
	9	php_error_docref(NULL TSRMLS_CC, E_WARNING, "count is out of range");
	10	RETURN_FALSE;
	11	}