Fix odd increments to repair the boundary checks.

diff --git a/main/rfc1867.c b/main/rfc1867.c
index ae24be38b48813bcc77a2b5e519d612b65381981..398b75598dfdba71c5e6439c132dc1b06512194a 100644 (file)
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -72,6 +72,10 @@ void php_mb_flush_gpc_variables(int num_vars, char **val_list, int *len_list, zv
 
 void php_mb_gpc_realloc_buffer(char ***pval_list, int **plen_list, int *num_vars_max, int inc  TSRMLS_DC)
 {
+       /* allow only even increments */
+       if (inc & 1) {
+               inc++;
+       }
        (*num_vars_max) += inc;
        *pval_list = (char **)erealloc(*pval_list, (*num_vars_max+2)*sizeof(char *));
        *plen_list = (int *)erealloc(*plen_list, (*num_vars_max+2)*sizeof(int));