Fix bug #64458 (dns_get_record result with string of length -1)

diff --git a/NEWS b/NEWS
index 0876c1e2fe7fbc54395379e9fb5e426d54fbdfe1..af4957e365c069a19abea8094c94c441a4cca387 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,7 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #64578 (debug_backtrace in set_error_handler corrupts zend heap: 
     segfault). (Laruence)
+  . Fixed bug #64458 (dns_get_record result with string of length -1). (Stas)
   . Fixed bugs #47675 and #64577 (fd leak on Solaris)
 
 - Zip:

diff --git a/ext/standard/dns.c b/ext/standard/dns.c
index 7bf7ccac8500efd28b39f13806f31d4cbc3bc206..8e24a817ffc6ef8efd3a34befe0847007d7eaa59 100644 (file)
--- a/ext/standard/dns.c
+++ b/ext/standard/dns.c
@@ -514,7 +514,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
                                tp[dlen] = '\0';
                                cp += dlen;
 
-                               add_assoc_stringl(*subarray, "txt", tp, dlen - 1, 0);
+                               add_assoc_stringl(*subarray, "txt", tp, (dlen>0)?dlen - 1:0, 0);
                                add_assoc_zval(*subarray, "entries", entries);
                        }
                        break;