diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2011-07-05 20:10:45 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2011-07-05 20:10:45 +0000 |
| commit | 1a4456bb767a344d6542bb6a7c8165ff1931514c (patch) | |
| tree | 6d3f49700f9861a79bb1a6fa7a024820fa1b72c0 | |
| parent | 5842a4147f25c9108d3a123d2304bd1d02b6acc2 (diff) | |
| download | php-git-1a4456bb767a344d6542bb6a7c8165ff1931514c.tar.gz | |
Fixed bug relating to un-initialized memory access
| -rw-r--r-- | ext/standard/crypt_sha256.c | 3 | ||||
| -rw-r--r-- | ext/standard/crypt_sha512.c | 4 |
2 files changed, 4 insertions, 3 deletions
diff --git a/ext/standard/crypt_sha256.c b/ext/standard/crypt_sha256.c index 26260992ef..231206bca1 100644 --- a/ext/standard/crypt_sha256.c +++ b/ext/standard/crypt_sha256.c @@ -395,9 +395,10 @@ char * php_sha256_crypt_r(const char *key, const char *salt, char *buffer, int b } if ((salt - (char *) 0) % __alignof__(uint32_t) != 0) { - char *tmp = (char *) alloca(salt_len + __alignof__(uint32_t)); + char *tmp = (char *) alloca(salt_len + 1 + __alignof__(uint32_t)); salt = copied_salt = memcpy(tmp + __alignof__(uint32_t) - (tmp - (char *) 0) % __alignof__ (uint32_t), salt, salt_len); + tmp[salt_len] = 0; } /* Prepare for the real work. */ diff --git a/ext/standard/crypt_sha512.c b/ext/standard/crypt_sha512.c index a51e11a37c..708ad67caa 100644 --- a/ext/standard/crypt_sha512.c +++ b/ext/standard/crypt_sha512.c @@ -430,8 +430,8 @@ php_sha512_crypt_r(const char *key, const char *salt, char *buffer, int buflen) } if ((salt - (char *) 0) % __alignof__ (uint64_t) != 0) { - char *tmp = (char *) alloca(salt_len + __alignof__(uint64_t)); - + char *tmp = (char *) alloca(salt_len + 1 + __alignof__(uint64_t)); + tmp[salt_len] = 0; salt = copied_salt = memcpy(tmp + __alignof__(uint64_t) - (tmp - (char *) 0) % __alignof__(uint64_t), salt, salt_len); } |