diff options
| author | Ferenc Kovacs <tyrael@php.net> | 2014-06-04 03:22:00 +0200 |
|---|---|---|
| committer | Ferenc Kovacs <tyrael@php.net> | 2014-06-04 03:22:00 +0200 |
| commit | 4ed171378978f3259af726d51ebfa50c1610106f (patch) | |
| tree | 64142d5cabae688ec9d02abc612c2b9950858c0e /ext/standard/formatted_print.c | |
| parent | 57e698d58263edeb5e15d78e0a968298f65a439f (diff) | |
| parent | 848df6fcbe7b32f2c21ebdcfe1c1adb56753cad9 (diff) | |
| download | php-git-4ed171378978f3259af726d51ebfa50c1610106f.tar.gz | |
Merge branch 'PHP-5.6' into PHP-5.6.0
* PHP-5.6: (51 commits)
Fix tests
Fix possible segfault depending on memory location...
fix gcov data with some locales (again)
Update NEWS
Fixed startup segfault in non-debug builds Fixes issue #87
Fixed regression introduced by patch for bug #67072
Fixed bug #67329 fileinfo: NULL pointer deference flaw by processing certain CDF files
(re)add cve number in NEWS, from 5.4.29
NEWS
NEWS
NEWS
Fix bug #67326 fileinfo: cdf_read_short_sector insufficient boundary check
add NEWS block for 5.6.0RC1
Update NEWs
Update NEWs
Fixed bug #67359 (Segfault in recursiveDirectoryIterator)
Check for zero-length keys in spl_array_skip_protected and don't skip them.
added CVEs in NEWS
updated libmagic.patch for 5.6+
updated libmagic.patch for 5.4+
...
Conflicts:
NEWS
Diffstat (limited to 'ext/standard/formatted_print.c')
| -rw-r--r-- | ext/standard/formatted_print.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c index 3cd5839313..2592b1655d 100644 --- a/ext/standard/formatted_print.c +++ b/ext/standard/formatted_print.c @@ -376,6 +376,7 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC int alignment, currarg, adjusting, argnum, width, precision; char *format, *result, padding; int always_sign; + int format_len; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "+", &args, &argc) == FAILURE) { return NULL; @@ -414,11 +415,12 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC convert_to_string_ex(args[format_offset]); format = Z_STRVAL_PP(args[format_offset]); + format_len = Z_STRLEN_PP(args[format_offset]); result = emalloc(size); currarg = 1; - while (inpos<Z_STRLEN_PP(args[format_offset])) { + while (inpos<format_len) { int expprec = 0, multiuse = 0; zval *tmp; @@ -473,7 +475,7 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC /* space padding, the default */ } else if (format[inpos] == '+') { always_sign = 1; - } else if (format[inpos] == '\'') { + } else if (format[inpos] == '\'' && inpos+1<format_len) { padding = format[++inpos]; } else { PRINTF_DEBUG(("sprintf: end of modifiers\n")); |