pick up the safe alloc pieces from

19866fb76cf4c95d904ebb0e08592cf38303fae9

diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index 5cfc8adf14be0034ccd2552c771d2e41404e3e24..566392fbfd9f18a86494ead99258524e86bf2842 100644 (file)
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -2977,7 +2977,7 @@ PHP_FUNCTION(imap_utf7_encode)
        }
 
        /* allocate output buffer */
-       out = zend_string_alloc(outlen, 0);
+       out = zend_string_safe_alloc(1, outlen, 0, 0);
 
        /* encode input string */
        outp = (unsigned char*)ZSTR_VAL(out);

diff --git a/ext/standard/string.c b/ext/standard/string.c
index c3becb9daa641bab06444fb875e2a5ad180b1907..491e97a070f08a7361d7da3992f3347dc97a7d3d 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2490,7 +2490,7 @@ PHP_FUNCTION(substr_replace)
                                repl_str = Z_STR_P(repl);
                        }
 
-                       result = zend_string_alloc(Z_STRLEN_P(str) - l + ZSTR_LEN(repl_str), 0);
+                       result = zend_string_safe_alloc(1, Z_STRLEN_P(str) - l + ZSTR_LEN(repl_str), 0, 0);
 
                        memcpy(ZSTR_VAL(result), Z_STRVAL_P(str), f);
                        if (ZSTR_LEN(repl_str)) {
@@ -2599,14 +2599,14 @@ PHP_FUNCTION(substr_replace)
 
                                        result_len += ZSTR_LEN(repl_str);
                                        repl_idx++;
-                                       result = zend_string_alloc(result_len, 0);
+                                       result = zend_string_safe_alloc(1, result_len, 0, 0);
 
                                        memcpy(ZSTR_VAL(result), ZSTR_VAL(orig_str), f);
                                        memcpy((ZSTR_VAL(result) + f), ZSTR_VAL(repl_str), ZSTR_LEN(repl_str));
                                        memcpy((ZSTR_VAL(result) + f + ZSTR_LEN(repl_str)), ZSTR_VAL(orig_str) + f + l, ZSTR_LEN(orig_str) - f - l);
                                        zend_string_release(repl_str);
                                } else {
-                                       result = zend_string_alloc(result_len, 0);
+                                       result = zend_string_safe_alloc(1, result_len, 0, 0);
 
                                        memcpy(ZSTR_VAL(result), ZSTR_VAL(orig_str), f);
                                        memcpy((ZSTR_VAL(result) + f), ZSTR_VAL(orig_str) + f + l, ZSTR_LEN(orig_str) - f - l);
@@ -2614,7 +2614,7 @@ PHP_FUNCTION(substr_replace)
                        } else {
                                result_len += Z_STRLEN_P(repl);
 
-                               result = zend_string_alloc(result_len, 0);
+                               result = zend_string_safe_alloc(1, result_len, 0, 0);
 
                                memcpy(ZSTR_VAL(result), ZSTR_VAL(orig_str), f);
                                memcpy((ZSTR_VAL(result) + f), Z_STRVAL_P(repl), Z_STRLEN_P(repl));