From: Felipe Pena <felipe@php.net>
Date: Mon, 25 Feb 2008 22:40:45 +0000 (+0000)
Subject: Fixed bug #44242 (metaphone(CMXFXM) crashes PHP)
X-Git-Tag: php-5.2.6RC1~12
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9b730870a118b7ebb59c7cae7b92e940b86dd01f;p=php

Fixed bug #44242 (metaphone(CMXFXM) crashes PHP)
---

diff --git a/NEWS b/NEWS
index 52b68a9972..66eee29360 100644
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,7 @@ PHP                                                                        NEWS
 - Upgraded PCRE to version 7.6 (Nuno)
 
 
+- Fixed bug #44242 (metaphone('CMXFXM') crashes PHP). (Felipe)
 - Fixed bug #44216 (strftime segfaults on large negative value). (Derick)
 - Fixed bug #44200 (A crash in PDO when no bound targets exists and yet 
   bound parameters are present). (Ilia)
diff --git a/ext/standard/metaphone.c b/ext/standard/metaphone.c
index e985b67a8b..34952d8295 100644
--- a/ext/standard/metaphone.c
+++ b/ext/standard/metaphone.c
@@ -150,7 +150,12 @@ static char Lookahead(char *word, int how_far)
 						(*phoned_word)[p_idx++] = c; \
 					}
 /* Slap a null character on the end of the phoned word */
-#define End_Phoned_Word	{(*phoned_word)[p_idx] = '\0';}
+#define End_Phoned_Word	{ \
+							if (p_idx == max_buffer_len) { \
+								*phoned_word = erealloc(*phoned_word, max_buffer_len + 1); \
+							} \
+							(*phoned_word)[p_idx] = '\0'; \
+						}
 /* How long is the phoned word? */
 #define Phone_Len	(p_idx)
 
diff --git a/ext/standard/tests/strings/bug44242.phpt b/ext/standard/tests/strings/bug44242.phpt
new file mode 100644
index 0000000000..00adda2be6
--- /dev/null
+++ b/ext/standard/tests/strings/bug44242.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #44242 (metaphone('CMXFXM') crashes PHP)
+--FILE--
+<?php
+
+echo metaphone('CMXFXZ'), "\n";
+echo metaphone('CMXFXV'), "\n";
+echo metaphone('CMXFXZXZ'), "\n";
+
+?>
+--EXPECT--
+KMKSFKSS
+KMKSFKSF
+KMKSFKSSKSS