dmitry Thu May 25 06:40:04 2006 UTC
Modified files: (Branch: PHP_5_2)
/php-src NEWS
/php-src/sapi/cgi fastcgi.c
Log:
Fixed bug #37496 (FastCGI output buffer overrun)
http://cvs.php.net/viewcvs.cgi/php-src/NEWS?r1=1.2027.2.547.2.46&r2=1.2027.2.547.2.47&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.547.2.46 php-src/NEWS:1.2027.2.547.2.47
--- php-src/NEWS:1.2027.2.547.2.46 Wed May 24 23:14:08 2006
+++ php-src/NEWS Thu May 25 06:40:04 2006
@@ -53,6 +53,7 @@
- Fixed bug #37505 (touch() truncates large files). (Ilia)
- Fixed bug #37499 (CLI segmentation faults during cleanup with sybase-ct
extension enabled). (Tony)
+- Fixed bug #37496 (FastCGI output buffer overrun). (Piotr, Dmitry)
- Fixed bug #37487 (oci_fetch_array() array-type should always default to
OCI_BOTH). (Tony)
- Fixed bug #37395 (recursive mkdir() fails to create nonexistent directories
http://cvs.php.net/viewcvs.cgi/php-src/sapi/cgi/fastcgi.c?r1=1.4.2.13.2.4&r2=1.4.2.13.2.5&diff_format=u
Index: php-src/sapi/cgi/fastcgi.c
diff -u php-src/sapi/cgi/fastcgi.c:1.4.2.13.2.4
php-src/sapi/cgi/fastcgi.c:1.4.2.13.2.5
--- php-src/sapi/cgi/fastcgi.c:1.4.2.13.2.4 Mon May 22 09:22:20 2006
+++ php-src/sapi/cgi/fastcgi.c Thu May 25 06:40:04 2006
@@ -16,7 +16,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: fastcgi.c,v 1.4.2.13.2.4 2006/05/22 09:22:20 dmitry Exp $ */
+/* $Id: fastcgi.c,v 1.4.2.13.2.5 2006/05/25 06:40:04 dmitry Exp $ */
#include "php.h"
#include "fastcgi.h"
@@ -798,6 +798,7 @@
limit = sizeof(req->out_buf) - (req->out_pos - req->out_buf);
if (!req->out_hdr) {
limit -= sizeof(fcgi_header);
+ if (limit < 0) limit = 0;
}
if (len < limit) {
@@ -810,8 +811,10 @@
if (!req->out_hdr) {
open_packet(req, type);
}
- memcpy(req->out_pos, str, limit);
- req->out_pos += limit;
+ if (limit > 0) {
+ memcpy(req->out_pos, str, limit);
+ req->out_pos += limit;
+ }
if (!fcgi_flush(req, 0)) {
return -1;
}
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
