From: Ilia Alshanetsky <iliaa@php.net>
Date: Mon, 13 Mar 2006 14:37:10 +0000 (+0000)
Subject: Added overflow checks to wordwrap() function.
X-Git-Tag: php-5.1.3RC2~120
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=80ea07d30c820f71eabdf31d47571d892e064df2;p=php

Added overflow checks to wordwrap() function.
---

diff --git a/NEWS b/NEWS
index 0f77d95716..4f68751a54 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Mar 2006, PHP 5.1.3RC2
+- Added overflow checks to wordwrap() function. (Ilia)
 - Removed the E_STRICT deprecation notice from "var". (Ilia)
 - Fixed debug_zval_dump() to support private and protected members. (Dmitry)
 - Fixed bug #36629 (SoapServer::handle() exits on SOAP faults). (Dmitry)
diff --git a/ext/standard/string.c b/ext/standard/string.c
index 5ae92eeec7..4f2897ce53 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -676,12 +676,13 @@ PHP_FUNCTION(wordwrap)
 		/* Multiple character line break or forced cut */
 		if (linelength > 0) {
 			chk = (int)(textlen/linelength + 1);
+			newtext = safe_emalloc(chk, breakcharlen, textlen + 1);
 			alloced = textlen + chk * breakcharlen + 1;
 		} else {
 			chk = textlen;
 			alloced = textlen * (breakcharlen + 1) + 1;
+			newtext = safe_emalloc(textlen, (breakcharlen + 1), 1);
 		}
-		newtext = emalloc(alloced);
 
 		/* now keep track of the actual new text length */
 		newtextlen = 0;