fix missing erealloc in fix for bug #40091, spl_autoload_register of more than 1...

diff --git a/NEWS b/NEWS
index 9fe3e5323c13c062f3b07621ec3b435efda6e2b8..384fc41c4848587cfbf32c6ce3c489ac1a624a4e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? Jun 2009, PHP 5.2.10
 - Fixed bug #48514 (cURL extension uses same resource name for simple and
   multi APIs). (Felipe)
+- Fixed missing erealloc() in fix for Bug #40091 in spl_autoload_register.
+  (Greg)
 
 11 Jun 2009, PHP 5.2.10RC2
 - Updated timezone database to version 2009.9 (2009i) (Derick)

diff --git a/ext/spl/php_spl.c b/ext/spl/php_spl.c
index bf049368f9edf7b8df3a7625b802749936513221..eddb16f041100b6172f34a5ac9a7f39ea2a4b262 100755 (executable)
--- a/ext/spl/php_spl.c
+++ b/ext/spl/php_spl.c
@@ -464,6 +464,7 @@ PHP_FUNCTION(spl_autoload_register)
 
                if (obj_ptr && !(alfi.func_ptr->common.fn_flags & ZEND_ACC_STATIC)) {
                        /* add object id to the hash to ensure uniqueness, for more reference look at bug #40091 */
+                       lc_name = erealloc(lc_name, func_name_len + 2 + sizeof(zend_object_handle));
                        memcpy(lc_name + func_name_len, &Z_OBJ_HANDLE_PP(obj_ptr), sizeof(zend_object_handle));
                        func_name_len += sizeof(zend_object_handle);
                        lc_name[func_name_len] = '\0';