diff --git a/ext/dba/dba.c b/ext/dba/dba.c index 37f05ebb94fe7..60685474212f5 100644 --- a/ext/dba/dba.c +++ b/ext/dba/dba.c @@ -1062,6 +1062,11 @@ PHP_FUNCTION(dba_fetch) ZEND_PARSE_PARAMETERS_END(); } + if (ZEND_LONG_EXCEEDS_INT(skip)) { + zend_argument_value_error(3, "must be between %d and %d", INT_MIN, INT_MAX); + RETURN_THROWS(); + } + info = Z_DBA_INFO_P(id); CHECK_DBA_CONNECTION(info); diff --git a/ext/dba/tests/gh19885.phpt b/ext/dba/tests/gh19885.phpt new file mode 100644 index 0000000000000..987aea4f175a2 --- /dev/null +++ b/ext/dba/tests/gh19885.phpt @@ -0,0 +1,35 @@ +--TEST-- +GH-19885 (dba_fetch() segfault on large skip values) +--EXTENSIONS-- +dba +--SKIPIF-- + +--FILE-- +getMessage(), PHP_EOL; +} + +try { + dba_fetch("1", $db, PHP_INT_MAX); +} catch (\ValueError $e) { + echo $e->getMessage(), PHP_EOL; +} +// negative skip needs to remain acceptable albeit corrected down the line +var_dump(dba_fetch("1", $db, -1000000)); +?> +--EXPECTF-- +dba_fetch(): Argument #3 ($skip) must be between -%d and %d +dba_fetch(): Argument #3 ($skip) must be between -%d and %d + +Notice: dba_fetch(): Handler cdb accepts only skip values greater than or equal to zero, using skip=0 in %s on line %d +string(1) "1" diff --git a/ext/standard/head.c b/ext/standard/head.c index 0b497fdc42aab..f94c7f596c2c5 100644 --- a/ext/standard/head.c +++ b/ext/standard/head.c @@ -131,13 +131,9 @@ PHPAPI zend_result php_setcookie(zend_string *name, zend_string *value, time_t e * so in order to force cookies to be deleted, even on MSIE, we * pick an expiry date in the past */ - dt = php_format_date("D, d M Y H:i:s \\G\\M\\T", sizeof("D, d M Y H:i:s \\G\\M\\T")-1, 1, 0); smart_str_appends(&buf, "Set-Cookie: "); smart_str_append(&buf, name); - smart_str_appends(&buf, "=deleted; expires="); - smart_str_append(&buf, dt); - smart_str_appends(&buf, "; Max-Age=0"); - zend_string_free(dt); + smart_str_appends(&buf, "=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0"); } else { smart_str_appends(&buf, "Set-Cookie: "); smart_str_append(&buf, name);