iliaa           Mon Mar 13 14:37:10 2006 UTC

  Modified files:              (Branch: PHP_5_1)
    /php-src    NEWS 
    /php-src/ext/standard       string.c 
  Log:
  Added overflow checks to wordwrap() function.
  
  
http://cvs.php.net/viewcvs.cgi/php-src/NEWS?r1=1.2027.2.456&r2=1.2027.2.457&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.456 php-src/NEWS:1.2027.2.457
--- php-src/NEWS:1.2027.2.456   Mon Mar 13 00:03:22 2006
+++ php-src/NEWS        Mon Mar 13 14:37:10 2006
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Mar 2006, PHP 5.1.3RC2
+- Added overflow checks to wordwrap() function. (Ilia)
 - Removed the E_STRICT deprecation notice from "var". (Ilia)
 - Fixed debug_zval_dump() to support private and protected members. (Dmitry)
 - Fixed bug #36629 (SoapServer::handle() exits on SOAP faults). (Dmitry)
http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/string.c?r1=1.445.2.9&r2=1.445.2.10&diff_format=u
Index: php-src/ext/standard/string.c
diff -u php-src/ext/standard/string.c:1.445.2.9 
php-src/ext/standard/string.c:1.445.2.10
--- php-src/ext/standard/string.c:1.445.2.9     Sun Feb 26 10:49:50 2006
+++ php-src/ext/standard/string.c       Mon Mar 13 14:37:10 2006
@@ -18,7 +18,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: string.c,v 1.445.2.9 2006/02/26 10:49:50 helly Exp $ */
+/* $Id: string.c,v 1.445.2.10 2006/03/13 14:37:10 iliaa Exp $ */
 
 /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */
 
@@ -676,12 +676,13 @@
                /* Multiple character line break or forced cut */
                if (linelength > 0) {
                        chk = (int)(textlen/linelength + 1);
+                       newtext = safe_emalloc(chk, breakcharlen, textlen + 1);
                        alloced = textlen + chk * breakcharlen + 1;
                } else {
                        chk = textlen;
                        alloced = textlen * (breakcharlen + 1) + 1;
+                       newtext = safe_emalloc(textlen, (breakcharlen + 1), 1);
                }
-               newtext = emalloc(alloced);
 
                /* now keep track of the actual new text length */
                newtextlen = 0;

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to