From 4d55ff84a6bb83d970a532cc00e2c5218c815b94 Mon Sep 17 00:00:00 2001 From: anupamme Date: Sat, 25 Jul 2026 00:20:30 +0000 Subject: [PATCH] fix: use bounded strlcpy/snprintf in convert.c Unsafe C buffer function used without size checking Addresses utils.custom.buffer-overflow-strcpy --- php/ext/google/protobuf/convert.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/php/ext/google/protobuf/convert.c b/php/ext/google/protobuf/convert.c index 31deb742d7024..20f19084a12fa 100644 --- a/php/ext/google/protobuf/convert.c +++ b/php/ext/google/protobuf/convert.c @@ -432,7 +432,7 @@ void Convert_UpbToPhp(upb_MessageValue upb_val, zval* php_val, TypeInfo type, #else { char buf[21]; - int size = sprintf(buf, "%lld", upb_val.int64_val); + int size = snprintf(buf, sizeof(buf), "%lld", upb_val.int64_val); ZVAL_NEW_STR(php_val, zend_string_init(buf, size, 0)); } #endif @@ -443,7 +443,7 @@ void Convert_UpbToPhp(upb_MessageValue upb_val, zval* php_val, TypeInfo type, #else { char buf[21]; - int size = sprintf(buf, "%lld", (int64_t)upb_val.uint64_val); + int size = snprintf(buf, sizeof(buf), "%lld", (int64_t)upb_val.uint64_val); ZVAL_NEW_STR(php_val, zend_string_init(buf, size, 0)); } #endif