]> granicus.if.org Git - php/commitdiff
fix possible off-by-one in str_(i)replace()
authorAntony Dovgal <tony2001@php.net>
Thu, 15 Feb 2007 09:31:01 +0000 (09:31 +0000)
committerAntony Dovgal <tony2001@php.net>
Thu, 15 Feb 2007 09:31:01 +0000 (09:31 +0000)
ext/standard/string.c

index 18821db8b4562fbcfcb668817eda09f13a3c6532..5e671016d9d81eaa037c2aaa086b1a7866b641eb 100644 (file)
@@ -2531,7 +2531,7 @@ PHPAPI int php_char_to_str(char *str, uint len, char from, char *to, int to_len,
        }
        
        Z_STRLEN_P(result) = len + (char_count * (to_len - 1));
-       Z_STRVAL_P(result) = target = safe_emalloc(char_count, to_len, len);
+       Z_STRVAL_P(result) = target = safe_emalloc(char_count, to_len, len + 1);
        Z_TYPE_P(result) = IS_STRING;
        
        for (source = str; source < source_end; source++) {