diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2020-06-04 13:38:14 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-06-04 13:38:45 +0200 |
| commit | d65c85366dbf03c10f913358b2017931291a61ed (patch) | |
| tree | f7134afa23bfb1a6d264159d33c3e6a52d948419 | |
| parent | a230717fbb3f71c83e7c82263f4e3517b19d854f (diff) | |
| parent | ceae81665cc6d8dadf2103a3f9266150b076ab2a (diff) | |
| download | php-git-d65c85366dbf03c10f913358b2017931291a61ed.tar.gz | |
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
Fix #73527: Invalid memory access in php_filter_strip
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/filter/sanitizing_filters.c | 6 |
2 files changed, 6 insertions, 3 deletions
@@ -8,6 +8,9 @@ PHP NEWS . Fixed bug #79668 (get_defined_functions(true) may miss functions). (cmb, Nikita) +- Filter: + . Fixed bug #73527 (Invalid memory access in php_filter_strip). (cmb) + - PDO SQLite: . Fixed bug #79664 (PDOStatement::getColumnMeta fails on empty result set). (cmb) diff --git a/ext/filter/sanitizing_filters.c b/ext/filter/sanitizing_filters.c index 5b4fb4432c..c17dc0241e 100644 --- a/ext/filter/sanitizing_filters.c +++ b/ext/filter/sanitizing_filters.c @@ -110,7 +110,7 @@ static void php_filter_strip(zval *value, zend_long flags) { unsigned char *str; size_t i; - int c; + size_t c; zend_string *buf; /* Optimization for if no strip flags are set */ @@ -119,7 +119,7 @@ static void php_filter_strip(zval *value, zend_long flags) } str = (unsigned char *)Z_STRVAL_P(value); - buf = zend_string_alloc(Z_STRLEN_P(value) + 1, 0); + buf = zend_string_alloc(Z_STRLEN_P(value), 0); c = 0; for (i = 0; i < Z_STRLEN_P(value); i++) { if ((str[i] >= 127) && (flags & FILTER_FLAG_STRIP_HIGH)) { @@ -161,7 +161,7 @@ static void filter_map_apply(zval *value, filter_map *map) zend_string *buf; str = (unsigned char *)Z_STRVAL_P(value); - buf = zend_string_alloc(Z_STRLEN_P(value) + 1, 0); + buf = zend_string_alloc(Z_STRLEN_P(value), 0); c = 0; for (i = 0; i < Z_STRLEN_P(value); i++) { if ((*map)[str[i]]) { |