@- Fixed mem-overwrite in XML_Parse_Into_Struct. (Thies)

(PHP xml_parse_into_struct) buffer was sometimes short by 1.

diff --git a/ext/xml/xml.c b/ext/xml/xml.c
index bfcc14b403bc1c75192ec159233e045f8f9670ba..4afbf30f3e58079e6d40b7bc6b4cbb75ad79a375 100644 (file)
--- a/ext/xml/xml.c
+++ b/ext/xml/xml.c
@@ -819,7 +819,7 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
                                        /* check if the current tag already has a value - if yes append to that! */
                                        if (zend_hash_find((*parser->ctag)->value.ht,"value",sizeof("value"),(void **) &myval) == SUCCESS) {
                                                int newlen = (*myval)->value.str.len + decoded_len;
-                                               (*myval)->value.str.val = erealloc((*myval)->value.str.val,newlen);
+                                               (*myval)->value.str.val = erealloc((*myval)->value.str.val,newlen+1);
                                                strcpy((*myval)->value.str.val + (*myval)->value.str.len,decoded_value);
                                                (*myval)->value.str.len += decoded_len;
                                                efree(decoded_value);