Fixed bug #22154 (Possible crash when memory_limit is reached and

output buffering in addition to session.use_trans_sid is used).

diff --git a/main/output.c b/main/output.c
index 67d81d212dc190fa54d169f8aeeec30d13267774..7563743850319327d6b2c02ea2abf5c0a81e9773 100644 (file)
--- a/main/output.c
+++ b/main/output.c
@@ -379,15 +379,20 @@ PHPAPI void php_ob_set_internal_handler(php_output_handler_func_t internal_outpu
 
 /* {{{ php_ob_allocate
  */
-static inline void php_ob_allocate(TSRMLS_D)
+static inline void php_ob_allocate(uint text_length TSRMLS_DC)
 {
-       if (OG(active_ob_buffer).size<OG(active_ob_buffer).text_length) {
-               while (OG(active_ob_buffer).size <= OG(active_ob_buffer).text_length) {
-                       OG(active_ob_buffer).size+=OG(active_ob_buffer).block_size;
+       uint new_len = OG(active_ob_buffer).text_length + text_length;
+
+       if (OG(active_ob_buffer).size < new_len) {
+               uint buf_size = OG(active_ob_buffer).size;
+               while (buf_size <= new_len) {
+                       buf_size += OG(active_ob_buffer).block_size;
                }
-                       
-               OG(active_ob_buffer).buffer = (char *) erealloc(OG(active_ob_buffer).buffer, OG(active_ob_buffer).size+1);
+
+               OG(active_ob_buffer).buffer = (char *) erealloc(OG(active_ob_buffer).buffer, buf_size+1);
+               OG(active_ob_buffer).size = buf_size;
        }
+       OG(active_ob_buffer).text_length = new_len;
 }
 /* }}} */
 
@@ -589,9 +594,8 @@ static inline void php_ob_append(const char *text, uint text_length TSRMLS_DC)
        int original_ob_text_length;
 
        original_ob_text_length=OG(active_ob_buffer).text_length;
-       OG(active_ob_buffer).text_length = OG(active_ob_buffer).text_length + text_length;
 
-       php_ob_allocate(TSRMLS_C);
+       php_ob_allocate(text_length TSRMLS_CC);
        target = OG(active_ob_buffer).buffer+original_ob_text_length;
        memcpy(target, text, text_length);
        target[text_length]=0;
@@ -616,8 +620,7 @@ static inline void php_ob_prepend(const char *text, uint text_length)
        char *p, *start;
        TSRMLS_FETCH();
 
-       OG(active_ob_buffer).text_length += text_length;
-       php_ob_allocate(TSRMLS_C);
+       php_ob_allocate(text_length TSRMLS_CC);
 
        /* php_ob_allocate() may change OG(ob_buffer), so we can't initialize p&start earlier */
        p = OG(ob_buffer)+OG(ob_text_length);