Code: PHP_FUNCTION(mcrypt_generic)
{
	zval *mcryptind;
	char *data;
	int data_len;
	php_mcrypt *pm;
	unsigned char* data_s;
	int block_size, data_size;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rs", &mcryptind, &data, &data_len) == FAILURE) {
 		return;
 	}
 	ZEND_FETCH_RESOURCE(pm, php_mcrypt *, &mcryptind, -1, "MCrypt", le_mcrypt);
 	PHP_MCRYPT_INIT_CHECK
 
	if (data_len == 0) {
		php_error_docref(NULL TSRMLS_CC, E_WARNING, "An empty string was passed");
		RETURN_FALSE
	}

	/* Check blocksize */
 	if (mcrypt_enc_is_block_mode(pm->td) == 1) { /* It's a block algorithm */
 		block_size = mcrypt_enc_get_block_size(pm->td);
 		data_size = (((data_len - 1) / block_size) + 1) * block_size;
 		data_s = emalloc(data_size + 1);
 		memset(data_s, 0, data_size);
 		memcpy(data_s, data, data_len);
	} else { /* It's not a block algorithm */
		data_size = data_len;
		data_s = emalloc(data_size + 1);
 		memset(data_s, 0, data_size);
 		memcpy(data_s, data, data_len);
 	}
 	mcrypt_generic(pm->td, data_s, data_size);
 	data_s[data_size] = '\0';
 
	RETVAL_STRINGL(data_s, data_size, 1);
	efree(data_s);
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-190
Summary: Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the (1) mcrypt_generic and (2) mdecrypt_generic functions.
Commit Message: Fix bug #72455:  Heap Overflow due to integer overflows