From 9a1edea25b292e7324a9603e4efbd385b0c74fdf Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Mon, 9 Aug 2021 12:48:21 +0200 Subject: [PATCH] Fix #74544: Integer overflow in mysqli_real_escape_string() The patch has been provided by @johannes. --- ext/mysqli/mysqli_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/mysqli/mysqli_api.c b/ext/mysqli/mysqli_api.c index 9896ab8eda2c..8612a6043288 100644 --- a/ext/mysqli/mysqli_api.c +++ b/ext/mysqli/mysqli_api.c @@ -1971,7 +1971,7 @@ PHP_FUNCTION(mysqli_real_escape_string) { } MYSQLI_FETCH_RESOURCE_CONN(mysql, mysql_link, MYSQLI_STATUS_VALID); - newstr = zend_string_alloc(2 * escapestr_len, 0); + newstr = zend_string_safe_alloc(2, escapestr_len, 0, 0); ZSTR_LEN(newstr) = mysql_real_escape_string_quote(mysql->mysql, ZSTR_VAL(newstr), escapestr, escapestr_len, '\''); newstr = zend_string_truncate(newstr, ZSTR_LEN(newstr), 0);