diff options
| author | Anatol Belski <ab@php.net> | 2015-02-27 10:42:20 +0100 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2015-02-27 10:42:20 +0100 |
| commit | 30830bcefd080cf58231aa195418a4223497ea91 (patch) | |
| tree | 025068001955f3647988a8309056d0df27950948 /ext/pcre/php_pcre.c | |
| parent | 8f5676f73e57345b61447a27bc493b1b8f95ab5b (diff) | |
| download | php-git-30830bcefd080cf58231aa195418a4223497ea91.tar.gz | |
Fixed bug #69115 crash in mail
There were two issues
- php_pcre_replace could be used directly and sbject_str could be NULL
- the Windows sendmail variant was freeing something passed from the outside
Diffstat (limited to 'ext/pcre/php_pcre.c')
| -rw-r--r-- | ext/pcre/php_pcre.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c index 8a6ecb5817..502ec57f42 100644 --- a/ext/pcre/php_pcre.c +++ b/ext/pcre/php_pcre.c @@ -1221,7 +1221,11 @@ PHPAPI zend_string *php_pcre_replace_impl(pcre_cache_entry *pce, zend_string *su new_len = result_len + subject_len - start_offset; if (new_len > alloc_len) { alloc_len = new_len; /* now we know exactly how long it is */ - result = zend_string_realloc(result, alloc_len, 0); + if (NULL != result) { + result = zend_string_realloc(result, alloc_len, 0); + } else { + result = zend_string_alloc(alloc_len, 0); + } } /* stick that last bit of string on our output */ memcpy(&result->val[result_len], piece, subject_len - start_offset); |