]> granicus.if.org Git - php/commitdiff
fix buffer lengths passed to snprintf
authorRob Richards <rrichards@php.net>
Wed, 5 Oct 2005 22:35:11 +0000 (22:35 +0000)
committerRob Richards <rrichards@php.net>
Wed, 5 Oct 2005 22:35:11 +0000 (22:35 +0000)
ext/wddx/php_wddx_api.h
ext/wddx/wddx.c

index 1c34f173c556fdbe67c004e44e2861189ffa9c64..d49c559ec4653a2a0ced34f6c0fd2c3e7e722413 100644 (file)
@@ -47,6 +47,9 @@
 #define WDDX_VAR_S                             "<var name='%s'>"
 #define WDDX_VAR_E                             "</var>"
 
+#define WDDX_NUMBER_LEN                        17
+#define WDDX_VAR_S_LEN                 13
+
 #define php_wddx_add_chunk(packet, str)        smart_str_appends(packet, str)
 #define php_wddx_add_chunk_ex(packet, str, len)        smart_str_appendl(packet, str, len)
 #define php_wddx_add_chunk_static(packet, str) smart_str_appendl(packet, str, sizeof(str)-1)
index 2d1fa6450953a127ef3dabc7ef949e79a207634a..a6dc0280a7d3a95a7e392583814c3cba790c7339 100644 (file)
@@ -423,7 +423,7 @@ static void php_wddx_serialize_number(wddx_packet *packet, zval *var)
        tmp = *var;
        zval_copy_ctor(&tmp);
        convert_to_string(&tmp);
-       snprintf(tmp_buf, Z_STRLEN(tmp), WDDX_NUMBER, Z_STRVAL(tmp));
+       snprintf(tmp_buf, Z_STRLEN(tmp) + WDDX_NUMBER_LEN + 1, WDDX_NUMBER, Z_STRVAL(tmp));
        zval_dtor(&tmp);
 
        php_wddx_add_chunk(packet, tmp_buf);    
@@ -625,8 +625,8 @@ void php_wddx_serialize_var(wddx_packet *packet, zval *var, char *name, int name
 
        if (name) {
                name_esc = php_escape_html_entities(name, name_len, &name_esc_len, 0, ENT_QUOTES, NULL TSRMLS_CC);
-               tmp_buf = emalloc(name_esc_len + 1);
-               snprintf(tmp_buf, name_esc_len, WDDX_VAR_S, name_esc);
+               tmp_buf = emalloc(name_esc_len + WDDX_VAR_S_LEN + 1);
+               snprintf(tmp_buf, name_esc_len + WDDX_VAR_S_LEN + 1, WDDX_VAR_S, name_esc);
                php_wddx_add_chunk(packet, tmp_buf);
                efree(tmp_buf);
                efree(name_esc);