diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-11-03 22:53:05 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2016-11-03 22:53:05 -0700 |
| commit | 25d04ad8e3e4b415645f982178a274f7a36eeef6 (patch) | |
| tree | 9a6bf6839715f09d5b609f2e0cac986f143aa038 /ext/zip | |
| parent | 0bc6592307af27c81ab1717cc589adb2530565ac (diff) | |
| parent | d858b4c77fa28ff9b0a597141a58f51803bafc2b (diff) | |
| download | php-git-25d04ad8e3e4b415645f982178a274f7a36eeef6.tar.gz | |
Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
Add length check for bzcompress too - fix for bug #73356
More string length checks & fixes
More string length checks & fixes
Diffstat (limited to 'ext/zip')
| -rw-r--r-- | ext/zip/php_zip.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/ext/zip/php_zip.c b/ext/zip/php_zip.c index 779d9d1593..4685fb2486 100644 --- a/ext/zip/php_zip.c +++ b/ext/zip/php_zip.c @@ -1590,7 +1590,7 @@ static ZIPARCHIVE_METHOD(addEmptyDir) } if (dirname[dirname_len-1] != '/') { - s=(char *)emalloc(dirname_len+2); + s=(char *)safe_emalloc(dirname_len, 1, 2); strcpy(s, dirname); s[dirname_len] = '/'; s[dirname_len+1] = '\0'; @@ -1805,14 +1805,14 @@ static ZIPARCHIVE_METHOD(addFromString) ze_obj = Z_ZIP_P(self); if (ze_obj->buffers_cnt) { - ze_obj->buffers = (char **)erealloc(ze_obj->buffers, sizeof(char *) * (ze_obj->buffers_cnt+1)); + ze_obj->buffers = (char **)safe_erealloc(ze_obj->buffers, sizeof(char *), (ze_obj->buffers_cnt+1), 0); pos = ze_obj->buffers_cnt++; } else { ze_obj->buffers = (char **)emalloc(sizeof(char *)); ze_obj->buffers_cnt++; pos = 0; } - ze_obj->buffers[pos] = (char *)emalloc(ZSTR_LEN(buffer) + 1); + ze_obj->buffers[pos] = (char *)safe_emalloc(ZSTR_LEN(buffer), 1, 1); memcpy(ze_obj->buffers[pos], ZSTR_VAL(buffer), ZSTR_LEN(buffer) + 1); zs = zip_source_buffer(intern, ze_obj->buffers[pos], ZSTR_LEN(buffer), 0); |