Fixed bug #70667 (strtr() causes invalid writes and a crashes)

diff --git a/NEWS b/NEWS
index fcc1552ff39a12b553d5fdc801acb9373a7bc0df..6e0b58f6cf2218b0e34be80f737a08f29d4a61b5 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,9 @@ PHP                                                                        NEWS
 - Reflection:
   . Fixed bug #70650 (Wrong docblock assignment). (Marcio)
 
+- Standard:
+  . Fixed bug #70667 (strtr() causes invalid writes and a crashes). (Dmitry)
+
 01 Oct 2015, PHP 7.0.0 RC 4
 
 - Core:

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 2200762deac04c82cd0e51d067f7dd794884ef8b..3d5b76caa2d314dca21e1c90f2005f199aa44464 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -3004,7 +3004,7 @@ static void php_strtr_array(zval *return_value, zend_string *input, HashTable *p
        zend_ulong *num_bitset;
 
        /* we will collect all possible key lengths */
-       num_bitset = ecalloc((slen + (sizeof(zend_ulong)-1)) / sizeof(zend_ulong), sizeof(zend_ulong));
+       num_bitset = ecalloc((slen + sizeof(zend_ulong)) / sizeof(zend_ulong), sizeof(zend_ulong));
        memset(bitset, 0, sizeof(bitset));
 
        /* check if original array has numeric keys */

diff --git a/ext/standard/tests/strings/bug70667.phpt b/ext/standard/tests/strings/bug70667.phpt
new file mode 100644 (file)
index 0000000..fd3dead
--- /dev/null
+++ b/ext/standard/tests/strings/bug70667.phpt
@@ -0,0 +1,9 @@
+--TEST--
+Bug #70667 (strtr() causes invalid writes and a crashes)
+--FILE--
+<?php
+$a = array("{{language_id}}"=>"255", "{{partner_name}}"=>"test1");
+var_dump(strtr("Sign in to test1", $a));
+?>
+--EXPECT--
+string(16) "Sign in to test1"