Skip to content

Commit c30e83a

Browse files
committed
Apply the overflowing integer fix to the size parameters of the $_FILES array.
1 parent 8ac51b4 commit c30e83a

File tree

1 file changed

+13
-9
lines changed

1 file changed

+13
-9
lines changed

server/php/upload.class.php

+13-9
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
/*
3-
* jQuery File Upload Plugin PHP Class 5.13
3+
* jQuery File Upload Plugin PHP Class 5.13.1
44
* https://github.com/blueimp/jQuery-File-Upload
55
*
66
* Copyright 2010, Sebastian Tschan
@@ -104,19 +104,23 @@ protected function set_file_delete_url($file) {
104104
}
105105
}
106106

107-
protected function get_file_size($file_path, $clear_stat_cache = false) {
108-
if ($clear_stat_cache) {
109-
clearstatcache();
110-
}
111-
$size = filesize($file_path);
107+
// Fix for overflowing signed 32 bit integers,
108+
// works for sizes up to 2^32-1 bytes (4 GiB - 1):
109+
protected function fix_integer_overflow($size) {
112110
if ($size < 0) {
113-
// Fix for overflowing signed 32 bit integers,
114-
// works for files up to 2^32-1 bytes (4 GiB - 1) in size:
115111
$size += 2.0 * (PHP_INT_MAX + 1);
116112
}
117113
return $size;
118114
}
119115

116+
protected function get_file_size($file_path, $clear_stat_cache = false) {
117+
if ($clear_stat_cache) {
118+
clearstatcache();
119+
}
120+
return $this->fix_integer_overflow(filesize($file_path));
121+
122+
}
123+
120124
protected function get_file_object($file_name) {
121125
$file_path = $this->options['upload_dir'].$file_name;
122126
if (is_file($file_path) && $file_name[0] !== '.') {
@@ -336,7 +340,7 @@ protected function orient_image($file_path) {
336340
protected function handle_file_upload($uploaded_file, $name, $size, $type, $error, $index = null) {
337341
$file = new stdClass();
338342
$file->name = $this->trim_file_name($name, $type, $index);
339-
$file->size = intval($size);
343+
$file->size = $this->fix_integer_overflow(intval($size));
340344
$file->type = $type;
341345
if ($this->validate($uploaded_file, $file, $error, $index)) {
342346
$this->handle_form_data($file, $index);

0 commit comments

Comments
 (0)