Heap based buffer overflow in quoted_printable

Heap based buffer overflow in quoted_printable_encode

Sec Bug #64879	Heap based buffer overflow in quoted_printable_encode
Submitted:	2013-05-20 08:53 UTC	Modified:	2013-06-08 09:17 UTC
From:	stas@php.net	Assigned:	stas (profile)
Status:	Closed	Package:	Strings related
PHP Version:	5.3.25	OS:	*
Private report:	No	CVE-ID:	2013-2110

[2013-05-20 08:53 UTC] stas@php.net

Description:
------------
quoted_printable_encode calculates the string size wrong, so overflow is 
possible. 

Test script:
---------------
quoted_printable_encode(str_repeat("\xf4", 1000));

Expected result:
----------------
No crash

Actual result:
--------------
Segfault

Patches

quotedfix (last revision 2013-05-22 07:07 UTC by stas@php.net)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2013-05-20 08:54 UTC] stas@php.net

-CVE-ID: +CVE-ID: 2013-2110

[2013-06-05 05:01 UTC] stas@php.net

-Status: Open +Status: Closed -Assigned To: +Assigned To: stas

[2013-06-05 05:01 UTC] stas@php.net

The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.