Fix a couple of buffer overflows in mcrypt.c

zsuraski · zsuraski · commit 4bbb8a001e71 · 2001-07-10T12:57:28.000Z
diff --git a/ext/mcrypt/mcrypt.c b/ext/mcrypt/mcrypt.c
@@ -1251,7 +1251,7 @@ static void php_mcrypt_do_crypt (char* cipher, zval **key, zval **data, char *mo
 	else if (count == 1) {  /* only m_k_l = OK */
 		key_s = emalloc (key_length_sizes[0]);
 		memset (key_s, 0, key_length_sizes[0]);
-		memcpy (key_s, Z_STRVAL_PP(key), Z_STRLEN_PP(key));
+		memcpy (key_s, Z_STRVAL_PP(key), MIN(Z_STRLEN_PP(key), key_length_sizes[0]));
 		use_key_length = key_length_sizes[0];
 	}
 	else { /* derterminating smallest supported key > length of requested key */
@@ -1265,7 +1265,7 @@ static void php_mcrypt_do_crypt (char* cipher, zval **key, zval **data, char *mo
 		}
 		key_s = emalloc (use_key_length);
 		memset (key_s, 0, use_key_length);
-		memcpy (key_s, Z_STRVAL_PP(key), Z_STRLEN_PP(key));
+		memcpy (key_s, Z_STRVAL_PP(key), MIN(Z_STRLEN_PP(key), use_key_length));
 	}
 	mcrypt_free (key_length_sizes);
 	

Original file line number	Diff line number	Diff line change
`@@ -1251,7 +1251,7 @@ static void php_mcrypt_do_crypt (char* cipher, zval key, zval data, char *mo`
`1251`	`1251`	`else if (count == 1) { /* only m_k_l = OK */`
`1252`	`1252`	`key_s = emalloc (key_length_sizes[0]);`
`1253`	`1253`	`memset (key_s, 0, key_length_sizes[0]);`
`1254`		`- memcpy (key_s, Z_STRVAL_PP(key), Z_STRLEN_PP(key));`
	`1254`	`+ memcpy (key_s, Z_STRVAL_PP(key), MIN(Z_STRLEN_PP(key), key_length_sizes[0]));`
`1255`	`1255`	`use_key_length = key_length_sizes[0];`
`1256`	`1256`	`}`
`1257`	`1257`	`else { /* derterminating smallest supported key > length of requested key */`
`@@ -1265,7 +1265,7 @@ static void php_mcrypt_do_crypt (char* cipher, zval key, zval data, char *mo`
`1265`	`1265`	`}`
`1266`	`1266`	`key_s = emalloc (use_key_length);`
`1267`	`1267`	`memset (key_s, 0, use_key_length);`
`1268`		`- memcpy (key_s, Z_STRVAL_PP(key), Z_STRLEN_PP(key));`
	`1268`	`+ memcpy (key_s, Z_STRVAL_PP(key), MIN(Z_STRLEN_PP(key), use_key_length));`
`1269`	`1269`	`}`
`1270`	`1270`	`mcrypt_free (key_length_sizes);`
`1271`	`1271`