Fixed call to estrndup() with invalid length

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 22754aba9b7ac455b5e1238f181e20a9ab396326..3778534086968879be55958bc715bdfd073f0622 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -1054,7 +1054,7 @@ ZEND_API int zend_hash_get_current_key_ex(HashTable *ht, char **str_index, uint
        if (p) {
                if (p->nKeyLength) {
                        if (duplicate) {
-                               *str_index = estrndup(p->arKey, p->nKeyLength);
+                               *str_index = estrndup(p->arKey, p->nKeyLength-1);
                        } else {
                                *str_index = p->arKey;
                        }

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 9981ea5db80393ebc349b09c8ed2a21bc3ff2478..7459e4f9660af35b93aa0074d9af8753937c67be 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -701,7 +701,7 @@ static int array_user_key_compare(const void *a, const void *b TSRMLS_DC)
        s = *((Bucket **) b);
 
        if (f->nKeyLength) {
-               Z_STRVAL(key1) = estrndup(f->arKey, f->nKeyLength);
+               Z_STRVAL(key1) = estrndup(f->arKey, f->nKeyLength-1);
                Z_STRLEN(key1) = f->nKeyLength-1;
                Z_TYPE(key1) = IS_STRING;
        } else {
@@ -709,7 +709,7 @@ static int array_user_key_compare(const void *a, const void *b TSRMLS_DC)
                Z_TYPE(key1) = IS_LONG;
        }
        if (s->nKeyLength) {
-               Z_STRVAL(key2) = estrndup(s->arKey, s->nKeyLength);
+               Z_STRVAL(key2) = estrndup(s->arKey, s->nKeyLength-1);
                Z_STRLEN(key2) = s->nKeyLength-1;
                Z_TYPE(key2) = IS_STRING;
        } else {
@@ -2737,7 +2737,7 @@ PHP_FUNCTION(array_change_key_case)
                                zend_hash_index_update(Z_ARRVAL_P(return_value), num_key, entry, sizeof(entry), NULL);
                                break;
                        case HASH_KEY_IS_STRING:
-                               new_key=estrndup(string_key,str_key_len);
+                               new_key=estrndup(string_key,str_key_len - 1);
                                if (change_to_upper)
                                        php_strtoupper(new_key, str_key_len - 1);
                                else