summaryrefslogtreecommitdiff
path: root/ext/standard/string.c
diff options
context:
space:
mode:
Diffstat (limited to 'ext/standard/string.c')
-rw-r--r--ext/standard/string.c55
1 files changed, 35 insertions, 20 deletions
diff --git a/ext/standard/string.c b/ext/standard/string.c
index 022914625e..82aa97e8cd 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -998,12 +998,12 @@ PHP_FUNCTION(wordwrap)
/* Multiple character line break or forced cut */
if (linelength > 0) {
chk = (size_t)(ZSTR_LEN(text)/linelength + 1);
- newtext = zend_string_alloc(chk * breakchar_len + ZSTR_LEN(text), 0);
+ newtext = zend_string_safe_alloc(chk, breakchar_len, ZSTR_LEN(text), 0);
alloced = ZSTR_LEN(text) + chk * breakchar_len + 1;
} else {
chk = ZSTR_LEN(text);
alloced = ZSTR_LEN(text) * (breakchar_len + 1) + 1;
- newtext = zend_string_alloc(ZSTR_LEN(text) * (breakchar_len + 1), 0);
+ newtext = zend_string_safe_alloc(ZSTR_LEN(text), breakchar_len + 1, 0, 0);
}
/* now keep track of the actual new text length */
@@ -1245,8 +1245,8 @@ PHPAPI void php_implode(const zend_string *delim, zval *arr, zval *return_value)
len += ZSTR_LEN(*strptr);
}
} ZEND_HASH_FOREACH_END();
-
- str = zend_string_alloc(len + (numelems - 1) * ZSTR_LEN(delim), 0);
+ /* numelems can not be 0, we checked above */
+ str = zend_string_safe_alloc(numelems - 1, ZSTR_LEN(delim), len, 0);
cptr = ZSTR_VAL(str) + ZSTR_LEN(str);
*cptr = 0;
@@ -2344,7 +2344,7 @@ PHP_FUNCTION(chunk_split)
if ((size_t)chunklen > ZSTR_LEN(str)) {
/* to maintain BC, we must return original string + ending */
- result = zend_string_alloc(endlen + ZSTR_LEN(str), 0);
+ result = zend_string_safe_alloc(ZSTR_LEN(str), 1, endlen, 0);
memcpy(ZSTR_VAL(result), ZSTR_VAL(str), ZSTR_LEN(str));
memcpy(ZSTR_VAL(result) + ZSTR_LEN(str), end, endlen);
ZSTR_VAL(result)[ZSTR_LEN(result)] = '\0';
@@ -2710,7 +2710,7 @@ PHP_FUNCTION(quotemeta)
RETURN_FALSE;
}
- str = zend_string_alloc(2 * ZSTR_LEN(old), 0);
+ str = zend_string_safe_alloc(2, ZSTR_LEN(old), 0, 0);
for (p = ZSTR_VAL(old), q = ZSTR_VAL(str); p != old_end; p++) {
c = *p;
@@ -2740,7 +2740,8 @@ PHP_FUNCTION(quotemeta)
/* }}} */
/* {{{ proto int ord(string character)
- Returns ASCII value of character */
+ Returns ASCII value of character
+ Warning: This function is special-cased by zend_compile.c and so is bypassed for constant string argument */
PHP_FUNCTION(ord)
{
char *str;
@@ -2761,7 +2762,8 @@ PHP_FUNCTION(ord)
/* }}} */
/* {{{ proto string chr(int ascii)
- Converts ASCII code to a character */
+ Converts ASCII code to a character
+ Warning: This function is special-cased by zend_compile.c and so is bypassed for constant integer argument */
PHP_FUNCTION(chr)
{
zend_long c;
@@ -3231,7 +3233,11 @@ static zend_string *php_str_to_str_ex(zend_string *haystack,
/* Needle doesn't occur, shortcircuit the actual replacement. */
goto nothing_todo;
}
- new_str = zend_string_alloc(count * (str_len - needle_len) + ZSTR_LEN(haystack), 0);
+ if (str_len > needle_len) {
+ new_str = zend_string_safe_alloc(count, str_len - needle_len, ZSTR_LEN(haystack), 0);
+ } else {
+ new_str = zend_string_alloc(count * (str_len - needle_len) + ZSTR_LEN(haystack), 0);
+ }
e = s = ZSTR_VAL(new_str);
end = ZSTR_VAL(haystack) + ZSTR_LEN(haystack);
@@ -3308,8 +3314,12 @@ static zend_string *php_str_to_str_i_ex(zend_string *haystack, char *lc_haystack
zend_string_release(lc_needle);
goto nothing_todo;
}
-
- new_str = zend_string_alloc(count * (str_len - ZSTR_LEN(lc_needle)) + ZSTR_LEN(haystack), 0);
+
+ if (str_len > ZSTR_LEN(lc_needle)) {
+ new_str = zend_string_safe_alloc(count, str_len - ZSTR_LEN(lc_needle), ZSTR_LEN(haystack), 0);
+ } else {
+ new_str = zend_string_alloc(count * (str_len - ZSTR_LEN(lc_needle)) + ZSTR_LEN(haystack), 0);
+ }
e = s = ZSTR_VAL(new_str);
end = lc_haystack + ZSTR_LEN(haystack);
@@ -3387,7 +3397,11 @@ PHPAPI zend_string *php_str_to_str(char *haystack, size_t length, char *needle,
new_str = zend_string_init(haystack, length, 0);
return new_str;
} else {
- new_str = zend_string_alloc(count * (str_len - needle_len) + length, 0);
+ if (str_len > needle_len) {
+ new_str = zend_string_safe_alloc(count, str_len - needle_len, length, 0);
+ } else {
+ new_str = zend_string_alloc(count * (str_len - needle_len) + length, 0);
+ }
}
}
@@ -3815,7 +3829,7 @@ PHPAPI zend_string *php_addcslashes(zend_string *str, int should_free, char *wha
char *end;
char c;
size_t newlen;
- zend_string *new_str = zend_string_alloc(4 * ZSTR_LEN(str), 0);
+ zend_string *new_str = zend_string_safe_alloc(4, ZSTR_LEN(str), 0, 0);
php_charmask((unsigned char *)what, wlength, flags);
@@ -3890,7 +3904,7 @@ PHPAPI zend_string *php_addslashes(zend_string *str, int should_free)
do_escape:
offset = source - (char *)ZSTR_VAL(str);
- new_str = zend_string_alloc(offset + (2 * (ZSTR_LEN(str) - offset)), 0);
+ new_str = zend_string_safe_alloc(2, ZSTR_LEN(str) - offset, offset, 0);
memcpy(ZSTR_VAL(new_str), ZSTR_VAL(str), offset);
target = ZSTR_VAL(new_str) + offset;
@@ -4412,7 +4426,7 @@ PHP_FUNCTION(nl2br)
{
size_t repl_len = is_xhtml ? (sizeof("<br />") - 1) : (sizeof("<br>") - 1);
- result = zend_string_alloc(repl_cnt * repl_len + ZSTR_LEN(str), 0);
+ result = zend_string_safe_alloc(repl_cnt, repl_len, ZSTR_LEN(str), 0);
target = ZSTR_VAL(result);
}
@@ -4699,6 +4713,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, int *stateptr, const cha
size_t pos, i = 0;
char *allow_free = NULL;
const char *allow_actual;
+ char is_xml = 0;
if (stateptr)
state = *stateptr;
@@ -4794,10 +4809,10 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, int *stateptr, const cha
switch (state) {
case 1: /* HTML/XML */
lc = '>';
- if (*(p -1) == '-') {
+ if (is_xml && *(p -1) == '-') {
break;
}
- in_q = state = 0;
+ in_q = state = is_xml = 0;
if (allow) {
if (tp - tbuf >= PHP_TAG_BUF_SIZE) {
pos = tp - tbuf;
@@ -4926,8 +4941,8 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, int *stateptr, const cha
* state == 2 (PHP). Switch back to HTML.
*/
- if (state == 2 && p > buf+2 && strncasecmp(p-4, "<?xm", 4) == 0) {
- state = 1;
+ if (state == 2 && p > buf+4 && strncasecmp(p-4, "<?xm", 4) == 0) {
+ state = 1; is_xml=1;
break;
}
@@ -5596,7 +5611,7 @@ PHP_FUNCTION(money_format)
}
}
- str = zend_string_alloc(format_len + 1024, 0);
+ str = zend_string_safe_alloc(format_len, 1, 1024, 0);
if ((res_len = strfmon(ZSTR_VAL(str), ZSTR_LEN(str), format, value)) < 0) {
zend_string_free(str);
RETURN_FALSE;
View Lorry Controller Status