Commit 08c0e82
committed
ext/sockets: bound interface name copy in from_zval_write_ifindex()
The SIOCGIFINDEX fallback checked ZSTR_LEN against sizeof(ifr.ifr_name)
but did not return on overflow, then memcpy'd ZSTR_LEN+1 bytes into the
fixed ifr_name buffer, so an over-long interface name overran the stack.
This regressed in 3e9b530, which replaced the original bounded
strlcpy with an unguarded memcpy. Restore the strlcpy plus else-if guard,
matching PHP-8.4 and PHP-8.5.1 parent 0fff3cc commit 08c0e82
1 file changed
Lines changed: 3 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1281 | 1281 | | |
1282 | 1282 | | |
1283 | 1283 | | |
1284 | | - | |
| 1284 | + | |
| 1285 | + | |
1285 | 1286 | | |
1286 | | - | |
1287 | | - | |
1288 | | - | |
| 1287 | + | |
1289 | 1288 | | |
1290 | 1289 | | |
1291 | 1290 | | |
| |||
0 commit comments