diff options
| author | Remi Collet <remi@remirepo.net> | 2025-12-18 08:13:35 +0100 |
|---|---|---|
| committer | Remi Collet <remi@php.net> | 2025-12-18 08:13:35 +0100 |
| commit | 64096d0a04a58b3984cf744e10dcfb47413692a8 (patch) | |
| tree | 7af4bf798c1bfc3cc0d52252cfc4b271332b0c2b /php-cve-2025-14178.patch | |
| parent | 10714588d2209e64a05ed9a550d14b2191b5974a (diff) | |
GHSA-www2-q4fc-65wf
Fix Heap buffer overflow in array_merge()
CVE-2025-14178
Fix Information Leak of Memory in getimagesize
CVE-2025-14177
Diffstat (limited to 'php-cve-2025-14178.patch')
| -rw-r--r-- | php-cve-2025-14178.patch | 62 |
1 files changed, 62 insertions, 0 deletions
diff --git a/php-cve-2025-14178.patch b/php-cve-2025-14178.patch new file mode 100644 index 0000000..867ffba --- /dev/null +++ b/php-cve-2025-14178.patch @@ -0,0 +1,62 @@ +From e4516e52979e8b67d9d35dfdbcc5dc7368263fa2 Mon Sep 17 00:00:00 2001 +From: Niels Dossche <7771979+ndossche@users.noreply.github.com> +Date: Sun, 9 Nov 2025 13:23:11 +0100 +Subject: [PATCH 3/5] Fix GHSA-h96m-rvf9-jgm2 + +(cherry picked from commit 8b801151bd54b36aae4593ed6cfc096e8122b415) +--- + ext/standard/array.c | 7 ++++++- + .../tests/array/GHSA-h96m-rvf9-jgm2.phpt | 16 ++++++++++++++++ + 2 files changed, 22 insertions(+), 1 deletion(-) + create mode 100644 ext/standard/tests/array/GHSA-h96m-rvf9-jgm2.phpt + +diff --git a/ext/standard/array.c b/ext/standard/array.c +index 4b68040adc8..2960713d00e 100644 +--- a/ext/standard/array.c ++++ b/ext/standard/array.c +@@ -3798,7 +3798,7 @@ static zend_always_inline void php_array_merge_wrapper(INTERNAL_FUNCTION_PARAMET + int argc, i; + zval *src_entry; + HashTable *src, *dest; +- uint32_t count = 0; ++ uint64_t count = 0; + + ZEND_PARSE_PARAMETERS_START(0, -1) + Z_PARAM_VARIADIC('+', args, argc) +@@ -3818,6 +3818,11 @@ static zend_always_inline void php_array_merge_wrapper(INTERNAL_FUNCTION_PARAMET + count += zend_hash_num_elements(Z_ARRVAL_P(arg)); + } + ++ if (UNEXPECTED(count >= HT_MAX_SIZE)) { ++ zend_throw_error(NULL, "The total number of elements must be lower than %u", HT_MAX_SIZE); ++ RETURN_THROWS(); ++ } ++ + if (argc == 2) { + zval *ret = NULL; + +diff --git a/ext/standard/tests/array/GHSA-h96m-rvf9-jgm2.phpt b/ext/standard/tests/array/GHSA-h96m-rvf9-jgm2.phpt +new file mode 100644 +index 00000000000..2e3e85357e1 +--- /dev/null ++++ b/ext/standard/tests/array/GHSA-h96m-rvf9-jgm2.phpt +@@ -0,0 +1,16 @@ ++--TEST-- ++GHSA-h96m-rvf9-jgm2 ++--FILE-- ++<?php ++ ++$power = 20; // Chosen to be well within a memory_limit ++$arr = range(0, 2**$power); ++try { ++ array_merge(...array_fill(0, 2**(32-$power), $arr)); ++} catch (Error $e) { ++ echo $e->getMessage(), "\n"; ++} ++ ++?> ++--EXPECTF-- ++The total number of elements must be lower than %d +-- +2.52.0 + |