php-5.3.7-bug-50363.patch

   1 --- PHP_5_3/ext/standard/filters.c      2011/05/24 23:49:04     311406
   2 +++ PHP_5_3/ext/standard/filters.c      2011/05/24 23:49:26     311407
   3 @@ -1050,20 +1050,16 @@
   4                                 }
   5                         } /* break is missing intentionally */
   6
   7 -                       case 2: {
   8 -                               unsigned int nbl;
   9 -
  10 +                       case 2: {
  11                                 if (icnt <= 0) {
  12                                         goto out;
  13                                 }
  14 -                               nbl = (*ps >= 'A' ? *ps - 0x37 : *ps - 0x30);
  15
  16 -                               if (nbl > 15) {
  17 +                               if (!isxdigit((int) *ps)) {
  18                                         err = PHP_CONV_ERR_INVALID_SEQ;
  19                                         goto out;
  20                                 }
  21 -                               next_char = (next_char << 4) | nbl;
  22 -
  23 +                               next_char = (next_char << 4) | (*ps >= 'A' ? *ps - 0x37 : *ps - 0x30);
  24                                 scan_stat++;
  25                                 ps++, icnt--;
  26                                 if (scan_stat != 3) {