fix memnstr bug, by Laurent Gaffie

diff --git a/Zend/zend_operators.h b/Zend/zend_operators.h
index 2fa4097ec2fc1d59f142871fcd168bfaa7d5bae7..03a4ed35d46c94abf4867e91f24d5804d3bfde5d 100644 (file)
--- a/Zend/zend_operators.h
+++ b/Zend/zend_operators.h
@@ -220,6 +220,9 @@ zend_memnstr(char *haystack, char *needle, int needle_len, char *end)
        char *p = haystack;
        char ne = needle[needle_len-1];
 
+       if(needle_len > end-haystack) {
+               return NULL;
+       }
        end -= needle_len;
 
        while (p <= end) {

diff --git a/ext/standard/tests/strings/explode_bug.phpt b/ext/standard/tests/strings/explode_bug.phpt
new file mode 100644 (file)
index 0000000..9766f0b
--- /dev/null
+++ b/ext/standard/tests/strings/explode_bug.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Explode/memnstr bug
+--INI--
+error_reporting=2047
+memory_limit=256M
+--FILE--
+<?php
+$res = explode(str_repeat("A",145999999),1);
+var_dump($res);
+?>
+--EXPECTF--
+array(1) {
+  [0]=>
+  string(1) "1"
+}