From 98b45313096de1cef412854247cbe45421787fee Mon Sep 17 00:00:00 2001 From: Daniel Scherzer Date: Wed, 23 Sep 2026 18:28:33 -0700 Subject: [PATCH] ext/iconv: add a hardening assertion that `char_cnt` doesn't underflow --- ext/iconv/iconv.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ext/iconv/iconv.c b/ext/iconv/iconv.c index af4717a00a48..dad797ee14b4 100644 --- a/ext/iconv/iconv.c +++ b/ext/iconv/iconv.c @@ -1102,6 +1102,12 @@ static php_iconv_err_t _php_iconv_mime_encode(smart_str *pretval, const char *fn const unsigned char *p; size_t nbytes_required; + /* Some agents get confused about what char_cnt is; it will + * be at least 4 at this point; if caller messed up and gave + * too short of a max_line_len that was already caught above + * and handled with PHP_ICONV_ERR_TOO_BIG. */ + ZEND_ASSERT(char_cnt >= 4); + smart_str_appendc(pretval, 'Q'); char_cnt--; smart_str_appendc(pretval, '?');