From: Stanislav Malyshev <stas@php.net>
Date: Fri, 4 Nov 2016 03:45:13 +0000 (-0700)
Subject: Merge branch 'PHP-5.6' into PHP-7.0
X-Git-Tag: php-7.1.0RC6~24^2~2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6e12e49b5be06b4346e3d7802ea9b09f9f1abd7b;p=php

Merge branch 'PHP-5.6' into PHP-7.0

* PHP-5.6:
  More string length checks & fixes
---

6e12e49b5be06b4346e3d7802ea9b09f9f1abd7b
diff --cc ext/intl/locale/locale_methods.c
index 18a051fe20,39d80d524a..12cf6c1ce3
--- a/ext/intl/locale/locale_methods.c
+++ b/ext/intl/locale/locale_methods.c
@@@ -713,8 -705,10 +716,10 @@@ PHP_FUNCTION( locale_get_keywords 
          RETURN_FALSE;
      }
  
+ 	INTL_CHECK_LOCALE_LEN(strlen(loc_name));
+ 
      if(loc_name_len == 0) {
 -        loc_name = intl_locale_get_default(TSRMLS_C);
 +        loc_name = intl_locale_get_default();
      }
  
  	/* Get the keywords */
@@@ -1120,8 -1114,10 +1125,10 @@@ PHP_FUNCTION(locale_parse
          RETURN_FALSE;
      }
  
+     INTL_CHECK_LOCALE_LEN(strlen(loc_name));
+ 
      if(loc_name_len == 0) {
 -        loc_name = intl_locale_get_default(TSRMLS_C);
 +        loc_name = intl_locale_get_default();
      }
  
  	array_init( return_value );
diff --cc ext/zip/php_zip.c
index cfac566506,9f2b3768d3..473e231b46
--- a/ext/zip/php_zip.c
+++ b/ext/zip/php_zip.c
@@@ -1803,19 -1913,19 +1803,19 @@@ static ZIPARCHIVE_METHOD(addFromString
  		return;
  	}
  
 -	ze_obj = (ze_zip_object*) zend_object_store_get_object(this TSRMLS_CC);
 +	ze_obj = Z_ZIP_P(self);
  	if (ze_obj->buffers_cnt) {
- 		ze_obj->buffers = (char **)erealloc(ze_obj->buffers, sizeof(char *) * (ze_obj->buffers_cnt+1));
+ 		ze_obj->buffers = (char **)safe_erealloc(ze_obj->buffers, sizeof(char *), (ze_obj->buffers_cnt+1), 0);
  		pos = ze_obj->buffers_cnt++;
  	} else {
  		ze_obj->buffers = (char **)emalloc(sizeof(char *));
  		ze_obj->buffers_cnt++;
  		pos = 0;
  	}
- 	ze_obj->buffers[pos] = (char *)emalloc(ZSTR_LEN(buffer) + 1);
 -	ze_obj->buffers[pos] = (char *)safe_emalloc(buffer_len, 1, 1);
 -	memcpy(ze_obj->buffers[pos], buffer, buffer_len + 1);
++	ze_obj->buffers[pos] = (char *)safe_emalloc(ZSTR_LEN(buffer), 1, 1);
 +	memcpy(ze_obj->buffers[pos], ZSTR_VAL(buffer), ZSTR_LEN(buffer) + 1);
  
 -	zs = zip_source_buffer(intern, ze_obj->buffers[pos], buffer_len, 0);
 +	zs = zip_source_buffer(intern, ze_obj->buffers[pos], ZSTR_LEN(buffer), 0);
  
  	if (zs == NULL) {
  		RETURN_FALSE;