Fix for a possible crash in fgetcsv(). (Patch by Moriyoshi Koizumi)

diff --git a/ext/standard/file.c b/ext/standard/file.c
index a8f660fcd05d94df29aaad3dec3560ad817d5bb6..5d42adff725aac3e73e1d995a485ccb9d05cfa20 100644 (file)
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -2408,11 +2408,9 @@ enclosure:
                                e--;
                        }
 
-                       if (e - s) {
-                               buf2 = erealloc(buf2, buf2_len + (e - s) + 1);
-                               memcpy(buf2 + buf2_len, s, (e - s));
-                               buf2_len += e - s;
-                       }
+                       buf2 = erealloc(buf2, buf2_len + (e - s) + 1);
+                       memcpy(buf2 + buf2_len, s, (e - s));
+                       buf2_len += e - s;
 enclosure_done:
                        _php_fgetcsv_trim_enclosed(buf2, &buf2_len, enclosure);
                        CSV_ADD_ENTRY(buf2, buf2_len, 0);

diff --git a/ext/standard/tests/file/fgetcsv.phpt b/ext/standard/tests/file/fgetcsv.phpt
index 868212c033b6a320d7660e061c238e982ee8f980..a247c5f73ab26c88669721a1f1e53c91f9052d9d 100644 (file)
--- a/ext/standard/tests/file/fgetcsv.phpt
+++ b/ext/standard/tests/file/fgetcsv.phpt
@@ -22,7 +22,8 @@ various fgetcsv() functionality tests
                'aaa,"bbb   "',
                'aaa"aaa","bbb"bbb',
                'aaa"aaa""",bbb',
-               'aaa"\\"a","bbb"'
+               'aaa"\\"a","bbb"',
+               '""'
        );
 
        $file = dirname(__FILE__) . 'fgetcsv.csv';
@@ -156,3 +157,7 @@ array(2) {
   [1]=>
   string(3) "bbb"
 }
+array(1) {
+  [0]=>
+  string(0) ""
+}