Fixed bug relating to un-initialized memory access

diff --git a/ext/standard/crypt_sha256.c b/ext/standard/crypt_sha256.c
index 26260992ef0948218bdb0cedec25074c62daa4f0..231206bca14db293a7f1142b0b52821eace707eb 100644 (file)
--- a/ext/standard/crypt_sha256.c
+++ b/ext/standard/crypt_sha256.c
@@ -395,9 +395,10 @@ char * php_sha256_crypt_r(const char *key, const char *salt, char *buffer, int b
        }
 
        if ((salt - (char *) 0) % __alignof__(uint32_t) != 0) {
-               char *tmp = (char *) alloca(salt_len + __alignof__(uint32_t));
+               char *tmp = (char *) alloca(salt_len + 1 + __alignof__(uint32_t));
                salt = copied_salt =
                memcpy(tmp + __alignof__(uint32_t) - (tmp - (char *) 0) % __alignof__ (uint32_t), salt, salt_len);
+               tmp[salt_len] = 0;
        }
 
        /* Prepare for the real work.  */

diff --git a/ext/standard/crypt_sha512.c b/ext/standard/crypt_sha512.c
index a51e11a37c208a9fd6c72a8be7934c752ffcc572..708ad67caa3baaad74e41c2ceecb4052b2c60edd 100644 (file)
--- a/ext/standard/crypt_sha512.c
+++ b/ext/standard/crypt_sha512.c
@@ -430,8 +430,8 @@ php_sha512_crypt_r(const char *key, const char *salt, char *buffer, int buflen)
        }
 
        if ((salt - (char *) 0) % __alignof__ (uint64_t) != 0) {
-               char *tmp = (char *) alloca(salt_len + __alignof__(uint64_t));
-
+               char *tmp = (char *) alloca(salt_len + 1 + __alignof__(uint64_t));
+               tmp[salt_len] = 0;
                salt = copied_salt = memcpy(tmp + __alignof__(uint64_t) - (tmp - (char *) 0) % __alignof__(uint64_t), salt, salt_len);
        }