CVE-2016-5770 (C, published 2016-08-07T10:59Z)
Description: value: Integer overflow in the SplFileObject::fread function in spl_directory.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer argument, a related issue to CVE-2016-5096.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/php/php-src
Files changed:
ext/spl/spl_directory.c
Commit message: Fix bug #72262 - do not overflow int


Vulnerable code:
	
	
		}		
/* creates the object by 
   - allocating memory 
   called from 
	
   Load the 'other' object 
	
	
	
	
	
		
		
			if (ht && zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sbr", 
					&intern->u.file.open_mode, &intern->u.file.open_mode_len, 
		
	case SPL_FS_DIR:	
		
	
	
	
	
	
	
	
	
	
	
/* }}}*/   
	
	
	
	
   
   When the constructor gets called the object is already created 
	
	
	
	
	
	} else { 
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
ZEND_BEGIN_ARG_INFO(arginfo_info___construct, 0) 
ZEND_BEGIN_ARG_INFO(arginfo_dir___construct, 0) 
ZEND_BEGIN_ARG_INFO(arginfo_dir_it_seek, 0) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_r_dir___construct, 0, 0, 1) 
	
	
	
	
	
	
					
	
	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|sbr!", 
			&intern->u.file.open_mode, &intern->u.file.open_mode_len, 
			&use_include_path, &intern->u.file.zcontext) == FAILURE) {		
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);	
	
	
	
		RETURN_FALSE;		
	
	
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_flock, 0, 0, 1) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fseek, 0, 0, 1) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fgetss, 0, 0, 0) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fscanf, 1, 0, 1) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fwrite, 0, 0, 1) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_ftruncate, 0, 0, 1) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_seek, 0, 0, 1) 
	
	

Fixed code:


		}
/* creates the object by
   - allocating memory
   called from

   Load the 'other' object







			if (ht && zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sbr",
					&intern->u.file.open_mode, &intern->u.file.open_mode_len,

	case SPL_FS_DIR:











/* }}}*/





   When the constructor gets called the object is already created





	} else {

















ZEND_BEGIN_ARG_INFO(arginfo_info___construct, 0)
ZEND_BEGIN_ARG_INFO(arginfo_dir___construct, 0)
ZEND_BEGIN_ARG_INFO(arginfo_dir_it_seek, 0)
ZEND_BEGIN_ARG_INFO_EX(arginfo_r_dir___construct, 0, 0, 1)








	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|sbr!",
			&intern->u.file.open_mode, &intern->u.file.open_mode_len,
			&use_include_path, &intern->u.file.zcontext) == FAILURE) {
















	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
	if (length > INT_MAX) {
		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be no more than %d", INT_MAX);
		RETURN_FALSE;
	}



		RETURN_FALSE;


ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_flock, 0, 0, 1)
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fseek, 0, 0, 1)
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fgetss, 0, 0, 0)
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fscanf, 1, 0, 1)
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fwrite, 0, 0, 1)
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_ftruncate, 0, 0, 1)
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_seek, 0, 0, 1)