Commit 009a0c2
committed
ext/sockets: bound interface name copy in from_zval_write_ifindex()
The SIOCGIFINDEX fallback checked ZSTR_LEN against sizeof(ifr.ifr_name)
but did not return on overflow, then memcpy'd ZSTR_LEN+1 bytes into the
fixed ifr_name buffer, so an over-long interface name overran the stack.
This regressed in 3e9b530, which replaced the original bounded
strlcpy with an unguarded memcpy. Restore the strlcpy plus else-if guard,
matching PHP-8.4.
Closes GH-223791 parent 3154731 commit 009a0c2
1 file changed
Lines changed: 3 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1270 | 1270 | | |
1271 | 1271 | | |
1272 | 1272 | | |
1273 | | - | |
| 1273 | + | |
| 1274 | + | |
1274 | 1275 | | |
1275 | | - | |
1276 | | - | |
1277 | | - | |
| 1276 | + | |
1278 | 1277 | | |
1279 | 1278 | | |
1280 | 1279 | | |
| |||
0 commit comments