Fix odd increments to repair the boundary checks.

diff --git a/main/rfc1867.c b/main/rfc1867.c
index 0515494bdec2e9154913a6b0d67ab1ccef420001..1eaa0096ed5c5eec2c4e54a7529db9ad46faef2e 100644 (file)
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -73,6 +73,10 @@ void php_mb_flush_gpc_variables(int num_vars, char **val_list, int *len_list, zv
 
 void php_mb_gpc_realloc_buffer(char ***pval_list, int **plen_list, int *num_vars_max, int inc  TSRMLS_DC)
 {
+       /* allow only even increments */
+       if (inc & 1) {
+               inc++;
+       }
        (*num_vars_max) += inc;
        *pval_list = (char **)erealloc(*pval_list, (*num_vars_max+2)*sizeof(char *));
        *plen_list = (int *)erealloc(*plen_list, (*num_vars_max+2)*sizeof(int));