com php-src: Fix out of bounds access in gc_find_additional _buffer(): Zend/zend_gc.c

Commit:    549a30d2cd7756abc5f5116dfebe217098ade5c5
Author:    Nikita Popov <[email protected]>         Tue, 7 Mar 2017 13:16:06 +0100
Parents:   648b756f35fdfc1948126ce954a3f7d6bd479ba5
Branches:  PHP-7.0 PHP-7.1 master

Link:       http://git.php.net/?p=php-src.git;a=commitdiff;h=549a30d2cd7756abc5f5116dfebe217098ade5c5

Log:
Fix out of bounds access in gc_find_additional_buffer()

Changed paths:
  M  Zend/zend_gc.c


Diff:
diff --git a/Zend/zend_gc.c b/Zend/zend_gc.c
index 0b9ce8c..badbf34 100644
--- a/Zend/zend_gc.c
+++ b/Zend/zend_gc.c
@@ -275,9 +275,12 @@ static zend_always_inline gc_root_buffer* gc_find_additional_buffer(zend_refcoun
 
 	/* We have to check each additional_buffer to find which one holds the ref */
 	while (additional_buffer) {
-		gc_root_buffer *root = additional_buffer->buf + (GC_ADDRESS(GC_INFO(ref)) - GC_ROOT_BUFFER_MAX_ENTRIES);
-		if (root->ref == ref) {
-			return root;
+		uint32_t idx = GC_ADDRESS(GC_INFO(ref)) - GC_ROOT_BUFFER_MAX_ENTRIES;
+		if (idx < additional_buffer->used) {
+			gc_root_buffer *root = additional_buffer->buf + idx;
+			if (root->ref == ref) {
+				return root;
+			}
 		}
 		additional_buffer = additional_buffer->next;
 	}