5.4.16

fix CVE-2013-2110 - use correct formula to calculate string size
reduced the file size even more
2026-11-11 11:10:49 +00:00 · 2013-06-04 22:03:57 -07:00 · 2013-06-04 21:59:15 -07:00 · 2013-05-28 13:09:53 -07:00 · 2013-05-28 13:09:19 -07:00 · 2013-05-21 23:35:13 -07:00
6 changed files with 24 additions and 10 deletions
@@ -1,14 +1,16 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2013, PHP 5.4.16
+06 Jun 2013, PHP 5.4.16

 - Core:
-  . Fixed bug #64720 (SegFault on zend_deactivate). (Dmitry)
-  . Fixed bug #64729 (compilation failure on x32). (Gustavo)
-  . Fixed bug #64660 (Segfault on memory exhaustion within function definition).
-    (Stas, reported by Juha Kylmänen)
+  . Fixed bug #64879 (Heap based buffer overflow in quoted_printable_encode, 
+    CVE 2013-2110). (Stas)
  . Fixed bug #64853 (Use of no longer available ini directives causes crash on
    TS build). (Anatol)
+  . Fixed bug #64729 (compilation failure on x32). (Gustavo)
+  . Fixed bug #64720 (SegFault on zend_deactivate). (Dmitry)
+  . Fixed bug #64660 (Segfault on memory exhaustion within function definition).
+    (Stas, reported by Juha Kylmänen)

 - Calendar:
  . Fixed bug #64895 (Integer overflow in SndToJewish). (Remi)
@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=4
 PHP_RELEASE_VERSION=16
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -151,7 +151,7 @@ PHPAPI unsigned char *php_quot_print_encode(const unsigned char *str, size_t len
 	unsigned char c, *ret, *d;
 	char *hex = "0123456789ABCDEF";

-	ret = safe_emalloc(1, 3 * length + 3 * (((3 * length)/PHP_QPRINT_MAXL) + 1), 0);
+	ret = safe_emalloc(3, length + (((3 * length)/(PHP_QPRINT_MAXL-9)) + 1), 1);
 	d = ret;

 	while (length--) {
@@ -286,4 +286,4 @@ PHP_FUNCTION(quoted_printable_encode)
 * End:
 * vim600: sw=4 ts=4 fdm=marker
 * vim<600: sw=4 ts=4
- */
+ */
@@ -0,0 +1,12 @@
+--TEST--
+Bug #64879: quoted_printable_encode() wrong size calculation (CVE-2013-2110)
+--FILE--
+<?php
+
+quoted_printable_encode(str_repeat("\xf4", 1000)); 
+quoted_printable_encode(str_repeat("\xf4", 100000)); 
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Done
@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 4
 #define PHP_RELEASE_VERSION 16
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.4.16-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.4.16"
 #define PHP_VERSION_ID 50416
Author	SHA1	Message	Date
Stanislav Malyshev	09d2b01f38	5.4.16	2013-06-04 22:03:57 -07:00
Stanislav Malyshev	f16f5770c2	fix CVE-2013-2110 - use correct formula to calculate string size	2013-06-04 21:59:15 -07:00
Anatol Belski	d6c1fc97f4	reduced the file size even more the first second is what at least has to be	2013-05-28 13:09:53 -07:00
Anatol Belski	5a2dbd6b1b	Fixed bug #64916 finfo testcase contains copyrighted music. I wasn't able to produce a file causing exactly the same crash. However the first three seconds of the originally reported file are pretty enough to repro bug #64830. That reduces its size to 72k.	2013-05-28 13:09:19 -07:00
Stanislav Malyshev	fdbd854b79	5.4.16 RC1	2013-05-21 23:35:13 -07:00