Blame SOURCES/php-CVE-2019-10193.patch

35eea6
From a4b90be9fcd5e1668ac941cabce3b1ab38dbe326 Mon Sep 17 00:00:00 2001
35eea6
From: antirez <antirez@gmail.com>
35eea6
Date: Fri, 15 Mar 2019 17:10:16 +0100
35eea6
Subject: [PATCH] HyperLogLog: enlarge reghisto variable for safety.
35eea6
35eea6
---
35eea6
 src/hyperloglog.c | 7 ++++++-
35eea6
 1 file changed, 6 insertions(+), 1 deletion(-)
35eea6
35eea6
diff --git a/src/hyperloglog.c b/src/hyperloglog.c
35eea6
index e993bf26e1d..526510b43b9 100644
35eea6
--- a/src/hyperloglog.c
35eea6
+++ b/src/hyperloglog.c
35eea6
@@ -1017,7 +1017,12 @@ uint64_t hllCount(struct hllhdr *hdr, int *invalid) {
35eea6
     double m = HLL_REGISTERS;
35eea6
     double E;
35eea6
     int j;
35eea6
-    int reghisto[HLL_Q+2] = {0};
35eea6
+    /* Note that reghisto could be just HLL_Q+1, becuase this is the
35eea6
+     * maximum frequency of the "000...1" sequence the hash function is
35eea6
+     * able to return. However it is slow to check for sanity of the
35eea6
+     * input: instead we history array at a safe size: overflows will
35eea6
+     * just write data to wrong, but correctly allocated, places. */
35eea6
+    int reghisto[64] = {0};
35eea6
 
35eea6
     /* Compute register histogram */
35eea6
     if (hdr->encoding == HLL_DENSE) {