Fixed bug #37496 (FastCGI output buffer overrun)

diff --git a/NEWS b/NEWS
index fb41f7ad3dc46708d584bdd632b066dbed98d4f0..7600e7703cb3ba74a4cfc4d3842eadfbebd5c1fe 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -53,6 +53,7 @@ PHP                                                                        NEWS
 - Fixed bug #37505 (touch() truncates large files). (Ilia)
 - Fixed bug #37499 (CLI segmentation faults during cleanup with sybase-ct 
   extension enabled). (Tony)
+- Fixed bug #37496 (FastCGI output buffer overrun). (Piotr, Dmitry)
 - Fixed bug #37487 (oci_fetch_array() array-type should always default to
   OCI_BOTH). (Tony)
 - Fixed bug #37395 (recursive mkdir() fails to create nonexistent directories 

diff --git a/sapi/cgi/fastcgi.c b/sapi/cgi/fastcgi.c
index 609c68eac10a07264f0512944735a12653791de7..1a6cd54ac1587954eb30b0b22442c6a3e1125dfd 100644 (file)
--- a/sapi/cgi/fastcgi.c
+++ b/sapi/cgi/fastcgi.c
@@ -798,6 +798,7 @@ int fcgi_write(fcgi_request *req, fcgi_request_type type, const char *str, int l
        limit = sizeof(req->out_buf) - (req->out_pos - req->out_buf);
        if (!req->out_hdr) {
                limit -= sizeof(fcgi_header);
+               if (limit < 0) limit = 0;
        }
 
        if (len < limit) {
@@ -810,8 +811,10 @@ int fcgi_write(fcgi_request *req, fcgi_request_type type, const char *str, int l
                if (!req->out_hdr) {
                        open_packet(req, type);
                }
-               memcpy(req->out_pos, str, limit);
-               req->out_pos += limit;
+               if (limit > 0) {
+                       memcpy(req->out_pos, str, limit);
+                       req->out_pos += limit;
+               }
                if (!fcgi_flush(req, 0)) {
                        return -1;
                }