MFB: Fixed bug #44242 (metaphone('CMXFXM') crashes PHP)

diff --git a/ext/standard/metaphone.c b/ext/standard/metaphone.c
index deb1df8bac72feccc770ff31cd4710b13a53df00..37e11ed0d7ee03814786b754622bf21a3bf1f349 100644 (file)
--- a/ext/standard/metaphone.c
+++ b/ext/standard/metaphone.c
@@ -151,7 +151,12 @@ static char Lookahead(char *word, int how_far) /* {{{ */
                                                (*phoned_word)[p_idx++] = c; \
                                        }
 /* Slap a null character on the end of the phoned word */
-#define End_Phoned_Word        {(*phoned_word)[p_idx] = '\0';}
+#define End_Phoned_Word        { \
+                                                       if (p_idx == max_buffer_len) { \
+                                                               *phoned_word = erealloc(*phoned_word, max_buffer_len + 1); \
+                                                       } \
+                                                       (*phoned_word)[p_idx] = '\0'; \
+                                               }
 /* How long is the phoned word? */
 #define Phone_Len      (p_idx)
 

diff --git a/ext/standard/tests/strings/bug44242.phpt b/ext/standard/tests/strings/bug44242.phpt
new file mode 100644 (file)
index 0000000..00adda2
--- /dev/null
+++ b/ext/standard/tests/strings/bug44242.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #44242 (metaphone('CMXFXM') crashes PHP)
+--FILE--
+<?php
+
+echo metaphone('CMXFXZ'), "\n";
+echo metaphone('CMXFXV'), "\n";
+echo metaphone('CMXFXZXZ'), "\n";
+
+?>
+--EXPECT--
+KMKSFKSS
+KMKSFKSF
+KMKSFKSSKSS