Fixed #73496 (Invalid memory access in zend_inline_hash_func)

no test script is added because it requre too much memory

diff --git a/NEWS b/NEWS
index f78594b612a85ed31b6781f76a46b89929d5c32f..72c0b0963c863fd9886f694310b9f1ec3e5f59ce 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -39,6 +39,10 @@ PHP                                                                        NEWS
   . Fixed bug #73118 (is_callable callable name reports misleading value for
     anonymous classes). (Adam Saponara)
 
+- Streams:
+  . Fixed bug #73496 (Invalid memory access in zend_inline_hash_func).
+    (Laruence)
+
 
 16 Feb 2017 PHP 7.0.16
 

diff --git a/main/streams/filter.c b/main/streams/filter.c
index ecb4f5982a844c2b26c7659d1c8cbae742ac1038..6d388695563063f2d06d36a5d51fe9cafe164aba 100644 (file)
--- a/main/streams/filter.c
+++ b/main/streams/filter.c
@@ -252,10 +252,10 @@ PHPAPI php_stream_filter *php_stream_filter_create(const char *filtername, zval
        HashTable *filter_hash = (FG(stream_filters) ? FG(stream_filters) : &stream_filters_hash);
        php_stream_filter_factory *factory = NULL;
        php_stream_filter *filter = NULL;
-       int n;
+       size_t n;
        char *period;
 
-       n = (int)strlen(filtername);
+       n = strlen(filtername);
 
        if (NULL != (factory = zend_hash_str_find_ptr(filter_hash, filtername, n))) {
                filter = factory->create_filter(filtername, filterparams, persistent);
@@ -263,7 +263,7 @@ PHPAPI php_stream_filter *php_stream_filter_create(const char *filtername, zval
                /* try a wildcard */
                char *wildname;
 
-               wildname = emalloc(n+3);
+               wildname = safe_emalloc(1, n, 3);
                memcpy(wildname, filtername, n+1);
                period = wildname + (period - filtername);
                while (period && !filter) {