Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:23973 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 48738 invoked by uid 1010); 6 Jun 2006 23:06:58 -0000 Delivered-To: ezmlm-scan-internals@lists.php.net Delivered-To: ezmlm-internals@lists.php.net Received: (qmail 48723 invoked from network); 6 Jun 2006 23:06:58 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 6 Jun 2006 23:06:58 -0000 X-Host-Fingerprint: 216.239.128.146 dev03.omnis.com Received: from ([216.239.128.146:21190] helo=localhost.localdomain) by pb1.pair.com (ecelerity 2.0 beta r(6323M)) with SMTP id BE/BF-00946-19A06844 for ; Tue, 06 Jun 2006 19:06:57 -0400 Message-ID: To: internals@lists.php.net Date: Tue, 06 Jun 2006 16:06:49 -0700 User-Agent: Thunderbird 1.5.0.4 (Windows/20060516) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="------------040801030403060703000208" X-Posted-By: 216.239.128.146 Subject: Binary searches From: johnjawed@gmail.com (john) --------------040801030403060703000208 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Attached is a patch which addresses array indices being out of bounds in pcre and libxmlrpc binary searches. John --------------040801030403060703000208 Content-Type: text/x-patch; name="b_search.patch" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="b_search.patch" Index: ext/pcre/pcrelib/pcre_get.c =================================================================== RCS file: /repository/php-src/ext/pcre/pcrelib/pcre_get.c,v retrieving revision 1.2 diff -u -r1.2 pcre_get.c --- ext/pcre/pcrelib/pcre_get.c 6 Mar 2006 21:34:07 -0000 1.2 +++ ext/pcre/pcrelib/pcre_get.c 6 Jun 2006 22:59:42 -0000 @@ -79,9 +79,10 @@ return rc; bot = 0; +int mid = 0; while (top > bot) { - int mid = (top + bot) / 2; + mid = ((unsigned) top + bot) >> 1; uschar *entry = nametable + entrysize*mid; int c = strcmp(stringname, (char *)(entry + 2)); if (c == 0) return (entry[0] << 8) + entry[1]; Index: ext/xmlrpc/libxmlrpc/queue.c =================================================================== RCS file: /repository/php-src/ext/xmlrpc/libxmlrpc/queue.c,v retrieving revision 1.4 diff -u -r1.4 queue.c --- ext/xmlrpc/libxmlrpc/queue.c 5 Jul 2002 04:43:53 -0000 1.4 +++ ext/xmlrpc/libxmlrpc/queue.c 6 Jun 2006 22:59:44 -0000 @@ -859,7 +859,7 @@ hi = q->size - 1; while(low <= hi) { - mid = (low + hi) / 2; + mid = ((unsigned) (low + high)) >> 1; val = Comp(key, index[ mid ]); if(val < 0) --------------040801030403060703000208--