mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-24 10:24:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed a possible memory corruption in pack(). Reported by Stefan Esser

Browse Source
This commit is contained in:
Dmitry Stogov 2010-05-12 11:04:57 +00:00
parent ad15797925
commit 27ef344f2b
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -26,6 +26,8 @@ PHP NEWS
- Fixed a possible memory corruption because of unexpected call-time pass by
refernce and following memory clobbering through callbacks.
Reported by Stefan Esser (Dmitry)
- Fixed a possible memory corruption in pack(). Reported by Stefan Esser
(Dmitry)
- Fixed a possible memory corruption in substr_replace(). Reported by Stefan
Esser (Dmitry)
- Fixed a possible memory corruption in addcslashes(). Reported by Stefan

12
ext/standard/pack.c
View File

@ -121,6 +121,9 @@ PHP_FUNCTION(pack)
return;
}
if (Z_ISREF_PP(argv[0])) {
SEPARATE_ZVAL(argv[0]);
}
convert_to_string_ex(argv[0]);
format = Z_STRVAL_PP(argv[0]);
@ -179,6 +182,9 @@ PHP_FUNCTION(pack)
}
if (arg < 0) {
if (Z_ISREF_PP(argv[currentarg])) {
SEPARATE_ZVAL(argv[currentarg]);
}
convert_to_string_ex(argv[currentarg]);
arg = Z_STRLEN_PP(argv[currentarg]);
}
@ -312,6 +318,9 @@ PHP_FUNCTION(pack)
case 'A':
memset(&output[outputpos], (code == 'a') ? '\0' : ' ', arg);
val = argv[currentarg++];
if (Z_ISREF_PP(val)) {
SEPARATE_ZVAL(val);
}
convert_to_string_ex(val);
memcpy(&output[outputpos], Z_STRVAL_PP(val),
(Z_STRLEN_PP(val) < arg) ? Z_STRLEN_PP(val) : arg);
@ -325,6 +334,9 @@ PHP_FUNCTION(pack)
char *v;
val = argv[currentarg++];
if (Z_ISREF_PP(val)) {
SEPARATE_ZVAL(val);
}
convert_to_string_ex(val);
v = Z_STRVAL_PP(val);
outputpos--;