Added overflow checks to wordwrap() function.

diff --git a/NEWS b/NEWS
index 0f77d95716dde09576dbbc531c5d8b3b312afc03..4f68751a549fd2cb89bebf1e46f18a9a0dd25a30 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Mar 2006, PHP 5.1.3RC2
+- Added overflow checks to wordwrap() function. (Ilia)
 - Removed the E_STRICT deprecation notice from "var". (Ilia)
 - Fixed debug_zval_dump() to support private and protected members. (Dmitry)
 - Fixed bug #36629 (SoapServer::handle() exits on SOAP faults). (Dmitry)

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 5ae92eeec7bb5f11f3328018486027201af626b8..4f2897ce53d85f379ba47e26734ec09eb0a63865 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -676,12 +676,13 @@ PHP_FUNCTION(wordwrap)
                /* Multiple character line break or forced cut */
                if (linelength > 0) {
                        chk = (int)(textlen/linelength + 1);
+                       newtext = safe_emalloc(chk, breakcharlen, textlen + 1);
                        alloced = textlen + chk * breakcharlen + 1;
                } else {
                        chk = textlen;
                        alloced = textlen * (breakcharlen + 1) + 1;
+                       newtext = safe_emalloc(textlen, (breakcharlen + 1), 1);
                }
-               newtext = emalloc(alloced);
 
                /* now keep track of the actual new text length */
                newtextlen = 0;