Hi Derick and Joe,
html_entity_decode('  ‘†′⁄€',
ENT_QUOTES, 'UTF-8'); (same testcase bug #29119) is causing Segfault in
NetWare.

The cause of the segfault seems to be the size of ent_uni_338_402. Which
I persume should be of size 402-338+1=65

It used to be 63 in size till 1.97.2.5.

Bug fix 28067 by Derick seemed to have increased the size by 65 but with
wrong comment ending.
It resulted in the code as follows,
/* 376 (0x0178) <Caution>No end comment</Caution>
          "Yuml", NULL, NULL, NULL, NULL, NULL, NULL, NULL, 
NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
/* 400 (0x0190)*/ 
NULL, NULL, "fnof"

Later Joe Orton fixed the above improper comment by extending the
comment to 3 more lines.
/* 376 (0x0178) <Caution>No end comment</Caution>
          "Yuml", NULL, NULL, NULL, NULL, NULL, NULL, NULL, 
NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
/* 400 (0x0190)*/ 
hence the array ent_uni_338_402 got truncated greatly to the size of 41
bytes.

This causes a seg fault while php_unescape_html_entities access from
ent_uni_338_402 with the index 402-338=64


With regards
Kamesh Jayachandran

-- 
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to