PHP 5.4SVN-2012-02-03 htmlspecialchars/entities Buffer Overflow

2012-02-03 15:15:03

From: cataphract
Operating system: Any
PHP version: 5.4SVN-2012-02-03 (SVN)
Package: Reproducible crash
Bug Type: Bug
Bug description:Buffer overflow on htmlspecialchars/entities with $double=false
Description:
------------
Long entities can cause a buffer overflow because the loop only guarantees
40 bytes available in beginning.
Test script:
---------------
<?php
echo
htmlspecialchars('"""""""""""""""""""""""""""""""""""""""""""""&#x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005;',
ENT_QUOTES, 'UTF-8', false), "\n";

Fixes

No fixes

In order to submit a new fix you need to be registered.