From d2331cc3f2fee2228b82def81c1e9557dd73d77c Mon Sep 17 00:00:00 2001 From: Jinesh Patel Date: Mon, 29 Jul 2019 14:19:52 -0400 Subject: Fix hash key length in umsg_parse_format() Fix array length passed to zend_hash_str_find_ptr() casting from UChar array to char array requires mul by sizeof(UChar). --- ext/intl/msgformat/msgformat_helpers.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'ext/intl/msgformat/msgformat_helpers.cpp') diff --git a/ext/intl/msgformat/msgformat_helpers.cpp b/ext/intl/msgformat/msgformat_helpers.cpp index 25fa3e5e1f..3e9b0d7f52 100644 --- a/ext/intl/msgformat/msgformat_helpers.cpp +++ b/ext/intl/msgformat/msgformat_helpers.cpp @@ -185,10 +185,10 @@ static HashTable *umsg_parse_format(MessageFormatter_object *mfo, if (name_part.getType() == UMSGPAT_PART_TYPE_ARG_NAME) { UnicodeString argName = mp.getSubstring(name_part); - if ((storedType = (Formattable::Type*)zend_hash_str_find_ptr(ret, (char*)argName.getBuffer(), argName.length())) == NULL) { + if ((storedType = (Formattable::Type*)zend_hash_str_find_ptr(ret, (char*)argName.getBuffer(), argName.length() * sizeof(UChar))) == NULL) { /* not found already; create new entry in HT */ Formattable::Type bogusType = Formattable::kObject; - if ((storedType = (Formattable::Type*)zend_hash_str_update_mem(ret, (char*)argName.getBuffer(), argName.length(), + if ((storedType = (Formattable::Type*)zend_hash_str_update_mem(ret, (char*)argName.getBuffer(), argName.length() * sizeof(UChar), (void*)&bogusType, sizeof(bogusType))) == NULL) { intl_errors_set(&err, U_MEMORY_ALLOCATION_ERROR, "Write to argument types hash table failed", 0); @@ -450,7 +450,7 @@ U_CFUNC void umsg_format_helper(MessageFormatter_object *mfo, continue; } - storedArgType = (Formattable::Type*)zend_hash_str_find_ptr(types, (char*)key.getBuffer(), key.length()); + storedArgType = (Formattable::Type*)zend_hash_str_find_ptr(types, (char*)key.getBuffer(), key.length() * sizeof(UChar)); } if (storedArgType != NULL) { -- cgit v1.2.1