From: George Peter Banyard <girgias@php.net>
Date: Fri, 13 Dec 2019 17:43:14 +0000 (+0100)
Subject: Revert "Remove dead code in libmbfl, memory device"
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=0a173abc842afdcce2f0bfe71a9a85995474e9ae;p=php

Revert "Remove dead code in libmbfl, memory device"

Stop trusting CLion's automatic dead code detection because it seems to be wrong
more often than not.
This reverts commit 612c86db3ea139e4ed4aa6a9aa28da343c9b39b8.
---

diff --git a/ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c b/ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c
index 7b87d645cc..0dd8ea2e66 100644
--- a/ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c
+++ b/ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c
@@ -148,6 +148,14 @@ mbfl_memory_device_output(int c, void *data)
 			/* overflow */
 			return -1;
 		}
+
+		newlen = device->length + device->allocsz;
+		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen);
+		if (tmp == NULL) {
+			return -1;
+		}
+		device->length = newlen;
+		device->buffer = tmp;
 	}
 
 	device->buffer[device->pos++] = (unsigned char)c;
@@ -168,6 +176,14 @@ mbfl_memory_device_output2(int c, void *data)
 			/* overflow */
 			return -1;
 		}
+
+		newlen = device->length + device->allocsz;
+		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen);
+		if (tmp == NULL) {
+			return -1;
+		}
+		device->length = newlen;
+		device->buffer = tmp;
 	}
 
 	device->buffer[device->pos++] = (unsigned char)((c >> 8) & 0xff);
@@ -190,6 +206,14 @@ mbfl_memory_device_output4(int c, void* data)
 			/* overflow */
 			return -1;
 		}
+
+		newlen = device->length + device->allocsz;
+		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen);
+		if (tmp == NULL) {
+			return -1;
+		}
+		device->length = newlen;
+		device->buffer = tmp;
 	}
 
 	device->buffer[device->pos++] = (unsigned char)((c >> 24) & 0xff);
@@ -221,6 +245,15 @@ mbfl_memory_device_strncat(mbfl_memory_device *device, const char *psrc, size_t
 			/* overflow */
 			return -1;
 		}
+
+		newlen = device->length + len + MBFL_MEMORY_DEVICE_ALLOC_SIZE;
+		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen);
+		if (tmp == NULL) {
+			return -1;
+		}
+
+		device->length = newlen;
+		device->buffer = tmp;
 	}
 
 	w = &device->buffer[device->pos];
@@ -274,6 +307,19 @@ mbfl_wchar_device_output(int c, void *data)
 			/* overflow */
 			return -1;
 		}
+
+		newlen = device->length + device->allocsz;
+		if (newlen > SIZE_MAX / sizeof(int)) {
+			/* overflow */
+			return -1;
+		}
+
+		tmp = (unsigned int *)mbfl_realloc((void *)device->buffer, newlen*sizeof(int));
+		if (tmp == NULL) {
+			return -1;
+		}
+		device->length = newlen;
+		device->buffer = tmp;
 	}
 
 	device->buffer[device->pos++] = c;