diff options
| author | Dmitry Stogov <dmitry@php.net> | 2005-04-25 06:13:57 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2005-04-25 06:13:57 +0000 |
| commit | c78ec1615a1442b3575d70d3f2882911d615edb0 (patch) | |
| tree | f7097b4225a2718afe2ecf79bdd0fd31867fc7c9 | |
| parent | 11a91f04b2660447f6180d789f1072dc2548cb53 (diff) | |
| download | php-git-c78ec1615a1442b3575d70d3f2882911d615edb0.tar.gz | |
Fixed call to estrndup() with invalid length
| -rw-r--r-- | Zend/zend_hash.c | 2 | ||||
| -rw-r--r-- | ext/standard/array.c | 6 |
2 files changed, 4 insertions, 4 deletions
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c index 22754aba9b..3778534086 100644 --- a/Zend/zend_hash.c +++ b/Zend/zend_hash.c @@ -1054,7 +1054,7 @@ ZEND_API int zend_hash_get_current_key_ex(HashTable *ht, char **str_index, uint if (p) { if (p->nKeyLength) { if (duplicate) { - *str_index = estrndup(p->arKey, p->nKeyLength); + *str_index = estrndup(p->arKey, p->nKeyLength-1); } else { *str_index = p->arKey; } diff --git a/ext/standard/array.c b/ext/standard/array.c index 9981ea5db8..7459e4f966 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -701,7 +701,7 @@ static int array_user_key_compare(const void *a, const void *b TSRMLS_DC) s = *((Bucket **) b); if (f->nKeyLength) { - Z_STRVAL(key1) = estrndup(f->arKey, f->nKeyLength); + Z_STRVAL(key1) = estrndup(f->arKey, f->nKeyLength-1); Z_STRLEN(key1) = f->nKeyLength-1; Z_TYPE(key1) = IS_STRING; } else { @@ -709,7 +709,7 @@ static int array_user_key_compare(const void *a, const void *b TSRMLS_DC) Z_TYPE(key1) = IS_LONG; } if (s->nKeyLength) { - Z_STRVAL(key2) = estrndup(s->arKey, s->nKeyLength); + Z_STRVAL(key2) = estrndup(s->arKey, s->nKeyLength-1); Z_STRLEN(key2) = s->nKeyLength-1; Z_TYPE(key2) = IS_STRING; } else { @@ -2737,7 +2737,7 @@ PHP_FUNCTION(array_change_key_case) zend_hash_index_update(Z_ARRVAL_P(return_value), num_key, entry, sizeof(entry), NULL); break; case HASH_KEY_IS_STRING: - new_key=estrndup(string_key,str_key_len); + new_key=estrndup(string_key,str_key_len - 1); if (change_to_upper) php_strtoupper(new_key, str_key_len - 1); else |