diff options
| author | Dmitry Stogov <dmitry@php.net> | 2011-07-11 09:47:59 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2011-07-11 09:47:59 +0000 |
| commit | adb87c8d060f7300cbf64484d5fa02c8d75f13fd (patch) | |
| tree | 7d7611eea2f28cabdebd54726ea5620606bb1bc2 /main | |
| parent | b9b749b70409e26d7b2fd6d92b3e9175455a5574 (diff) | |
| download | php-git-adb87c8d060f7300cbf64484d5fa02c8d75f13fd.tar.gz | |
Fixed bug #54332 (Crash in zend_mm_check_ptr // Heap corruption)
Diffstat (limited to 'main')
| -rw-r--r-- | main/snprintf.c | 5 | ||||
| -rw-r--r-- | main/spprintf.c | 5 |
2 files changed, 8 insertions, 2 deletions
diff --git a/main/snprintf.c b/main/snprintf.c index a1b253cfda..6e5a89a34c 100644 --- a/main/snprintf.c +++ b/main/snprintf.c @@ -497,8 +497,11 @@ char * ap_php_conv_p2(register u_wide_int num, register int nbits, char format, * NUM_BUF_SIZE is the size of the buffer used for arithmetic conversions * * XXX: this is a magic number; do not decrease it + * Emax = 1023 + * NDIG = 320 + * NUM_BUF_SIZE >= strlen("-") + Emax + strlrn(".") + NDIG + strlen("E+1023") + 1; */ -#define NUM_BUF_SIZE 512 +#define NUM_BUF_SIZE 2048 /* diff --git a/main/spprintf.c b/main/spprintf.c index 8c90fda378..8599d890ee 100644 --- a/main/spprintf.c +++ b/main/spprintf.c @@ -119,8 +119,11 @@ * NUM_BUF_SIZE is the size of the buffer used for arithmetic conversions * * XXX: this is a magic number; do not decrease it + * Emax = 1023 + * NDIG = 320 + * NUM_BUF_SIZE >= strlen("-") + Emax + strlrn(".") + NDIG + strlen("E+1023") + 1; */ -#define NUM_BUF_SIZE 512 +#define NUM_BUF_SIZE 2048 /* * The INS_CHAR macro inserts a character in the buffer. |