From: Ilia Alshanetsky <iliaa@php.net>
Date: Tue, 5 Jul 2011 20:10:45 +0000 (+0000)
Subject: Fixed bug relating to un-initialized memory access
X-Git-Tag: php-5.4.0alpha2~48
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1a4456bb767a344d6542bb6a7c8165ff1931514c;p=php

Fixed bug relating to un-initialized memory access
---

diff --git a/ext/standard/crypt_sha256.c b/ext/standard/crypt_sha256.c
index 26260992ef..231206bca1 100644
--- a/ext/standard/crypt_sha256.c
+++ b/ext/standard/crypt_sha256.c
@@ -395,9 +395,10 @@ char * php_sha256_crypt_r(const char *key, const char *salt, char *buffer, int b
 	}
 
 	if ((salt - (char *) 0) % __alignof__(uint32_t) != 0) {
-		char *tmp = (char *) alloca(salt_len + __alignof__(uint32_t));
+		char *tmp = (char *) alloca(salt_len + 1 + __alignof__(uint32_t));
 		salt = copied_salt =
 		memcpy(tmp + __alignof__(uint32_t) - (tmp - (char *) 0) % __alignof__ (uint32_t), salt, salt_len);
+		tmp[salt_len] = 0;
 	}
 
 	/* Prepare for the real work.  */
diff --git a/ext/standard/crypt_sha512.c b/ext/standard/crypt_sha512.c
index a51e11a37c..708ad67caa 100644
--- a/ext/standard/crypt_sha512.c
+++ b/ext/standard/crypt_sha512.c
@@ -430,8 +430,8 @@ php_sha512_crypt_r(const char *key, const char *salt, char *buffer, int buflen)
 	}
 
 	if ((salt - (char *) 0) % __alignof__ (uint64_t) != 0) {
-		char *tmp = (char *) alloca(salt_len + __alignof__(uint64_t));
-
+		char *tmp = (char *) alloca(salt_len + 1 + __alignof__(uint64_t));
+		tmp[salt_len] = 0;
 		salt = copied_salt = memcpy(tmp + __alignof__(uint64_t) - (tmp - (char *) 0) % __alignof__(uint64_t), salt, salt_len);
 	}