[PHP-CVS] svn: /php/php-src/branches/PHP_5_2/ext/standard/ string.c

[Felipe Pena]

felipe                                   Thu, 01 Jul 2010 19:51:36 +0000

Revision: http://svn.php.net/viewvc?view=revision&revision=300918

Log:
- Fixed a possible memory corruption in substr(), chunk_split(), strtok(), 
addcslashes(), str_repeat()

Changed paths:
    U   php/php-src/branches/PHP_5_2/ext/standard/string.c

Modified: php/php-src/branches/PHP_5_2/ext/standard/string.c
===================================================================
--- php/php-src/branches/PHP_5_2/ext/standard/string.c  2010-07-01 19:11:01 UTC 
(rev 300917)
+++ php/php-src/branches/PHP_5_2/ext/standard/string.c  2010-07-01 19:51:36 UTC 
(rev 300918)
@@ -1230,6 +1230,9 @@
                case 2:
                        str = args[0];
                        tok = args[1];
+                       if (PZVAL_IS_REF(*str)) {
+                               SEPARATE_ZVAL(str);
+                       }
                        convert_to_string_ex(str);

                        zval_add_ref(str);
@@ -2208,6 +2211,9 @@
                WRONG_PARAM_COUNT;
        }

+       if (PZVAL_IS_REF(*p_str)) {
+               SEPARATE_ZVAL(p_str);
+       }
        convert_to_string_ex(p_str);

        if (argc > 1) {
@@ -2263,6 +2269,9 @@
                WRONG_PARAM_COUNT;
        }

+       if (PZVAL_IS_REF(*str)) {
+               SEPARATE_ZVAL(str);
+       }
        convert_to_string_ex(str);
        convert_to_long_ex(from);

@@ -3059,6 +3068,9 @@
        if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &str, &what) == 
FAILURE) {
                WRONG_PARAM_COUNT;
        }
+       if (PZVAL_IS_REF(*str)) {
+               SEPARATE_ZVAL(str);
+       }
        convert_to_string_ex(str);
        convert_to_string_ex(what);

@@ -4632,6 +4644,9 @@
        }

        /* Make sure we're dealing with proper types */
+       if (PZVAL_IS_REF(*input_str)) {
+               SEPARATE_ZVAL(input_str);
+       }
        convert_to_string_ex(input_str);
        convert_to_long_ex(mult);



-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php