20017b
Adapted for 5.4.16 from
20017b
20017b
20017b
From 1494298231072d5991e76db5ef25f20e81018106 Mon Sep 17 00:00:00 2001
20017b
From: Rasmus Lerdorf <rasmus@lerdorf.com>
20017b
Date: Sun, 20 Oct 2013 08:55:48 -0700
20017b
Subject: [PATCH] Minor Coverity tweaks
20017b
20017b
---
20017b
 ext/ftp/ftp.c | 6 +++---
20017b
 1 file changed, 3 insertions(+), 3 deletions(-)
20017b
20017b
diff --git a/ext/ftp/ftp.c b/ext/ftp/ftp.c
20017b
index 58d3c2e..4da8d60 100644
20017b
--- a/ext/ftp/ftp.c
20017b
+++ b/ext/ftp/ftp.c
20017b
@@ -1635,7 +1635,7 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
20017b
 	if (ftp->resp == 226) {
20017b
 		ftp->data = data_close(ftp, data);
20017b
 		php_stream_close(tmpstream);
20017b
-		return ecalloc(1, sizeof(char**));
20017b
+		return ecalloc(1, sizeof(char*));
20017b
 	}
20017b
 
20017b
 	/* pull data buffer into tmpfile */
20017b
@@ -1663,11 +1663,11 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
20017b
 		}
20017b
 	}
20017b
 
20017b
-	ftp->data = data = data_close(ftp, data);
20017b
+	ftp->data = data_close(ftp, data);
20017b
 
20017b
 	php_stream_rewind(tmpstream);
20017b
 
20017b
-	ret = safe_emalloc((lines + 1), sizeof(char**), size * sizeof(char*));
20017b
+	ret = safe_emalloc((lines + 1), sizeof(char*), size * sizeof(char*));
20017b
 
20017b
 	entry = ret;
20017b
 	text = (char*) (ret + lines + 1);
20017b
-- 
20017b
2.1.4
20017b
20017b
From 8f4a6d6e1b6c36259a5dc865d16f0dad76f2f2c9 Mon Sep 17 00:00:00 2001
20017b
From: Rasmus Lerdorf <rasmus@lerdorf.com>
20017b
Date: Sun, 20 Oct 2013 09:36:50 -0700
20017b
Subject: [PATCH] Clean up this weird safe_emalloc() call
20017b
20017b
---
20017b
 ext/ftp/ftp.c | 2 +-
20017b
 1 file changed, 1 insertion(+), 1 deletion(-)
20017b
20017b
diff --git a/ext/ftp/ftp.c b/ext/ftp/ftp.c
20017b
index 4da8d60..b82017e 100644
20017b
--- a/ext/ftp/ftp.c
20017b
+++ b/ext/ftp/ftp.c
20017b
@@ -1667,7 +1667,7 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
20017b
 
20017b
 	php_stream_rewind(tmpstream);
20017b
 
20017b
-	ret = safe_emalloc((lines + 1), sizeof(char*), size * sizeof(char*));
20017b
+	ret = safe_emalloc((lines + 1), sizeof(char*), size);
20017b
 
20017b
 	entry = ret;
20017b
 	text = (char*) (ret + lines + 1);
20017b
-- 
20017b
2.1.4
20017b
20017b
From ac2832935435556dc593784cd0087b5e576bbe4d Mon Sep 17 00:00:00 2001
20017b
From: Stanislav Malyshev <stas@php.net>
20017b
Date: Wed, 29 Apr 2015 21:57:33 -0700
20017b
Subject: [PATCH] Fix bug #69545 - avoid overflow when reading list
20017b
20017b
---
20017b
 ext/ftp/ftp.c | 82 +++++++++++++++++++++++++++++------------------------------
20017b
 1 file changed, 41 insertions(+), 41 deletions(-)
20017b
20017b
diff --git a/ext/ftp/ftp.c b/ext/ftp/ftp.c
20017b
index 3ff54ff..53560eb 100644
20017b
--- a/ext/ftp/ftp.c
20017b
+++ b/ext/ftp/ftp.c
20017b
@@ -1603,8 +1603,8 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
20017b
 	databuf_t	*data = NULL;
20017b
 	char		*ptr;
20017b
 	int		ch, lastch;
20017b
-	int		size, rcvd;
20017b
-	int		lines;
20017b
+	size_t		size, rcvd;
20017b
+	size_t		lines;
20017b
 	char		**ret = NULL;
20017b
 	char		**entry;
20017b
 	char		*text;
20017b
@@ -1646,7 +1646,7 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
20017b
 	lines = 0;
20017b
 	lastch = 0;
20017b
 	while ((rcvd = my_recv(ftp, data->fd, data->buf, FTP_BUFSIZE))) {
20017b
-		if (rcvd == -1) {
20017b
+		if (rcvd == -1 || rcvd > ((size_t)(-1))-size) {
20017b
 			goto bail;
20017b
 		}
20017b
 
20017b
-- 
20017b
2.1.4
20017b
20017b
From 0765623d6991b62ffcd93ddb6be8a5203a2fa7e2 Mon Sep 17 00:00:00 2001
20017b
From: Stanislav Malyshev <stas@php.net>
20017b
Date: Sun, 31 May 2015 17:23:06 -0700
20017b
Subject: [PATCH] improve fix for Bug #69545
20017b
20017b
---
20017b
 NEWS          | 4 ++++
20017b
 ext/ftp/ftp.c | 2 --
20017b
 2 files changed, 4 insertions(+), 2 deletions(-)
20017b
20017b
diff --git a/ext/ftp/ftp.c b/ext/ftp/ftp.c
20017b
index 53560eb..50d8def 100644
20017b
--- a/ext/ftp/ftp.c
20017b
+++ b/ext/ftp/ftp.c
20017b
@@ -1656,8 +1656,6 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
20017b
 		for (ptr = data->buf; rcvd; rcvd--, ptr++) {
20017b
 			if (*ptr == '\n' && lastch == '\r') {
20017b
 				lines++;
20017b
-			} else {
20017b
-				size++;
20017b
 			}
20017b
 			lastch = *ptr;
20017b
 		}
20017b
-- 
20017b
2.1.4
20017b