From: Felipe Pena <felipe@php.net>
Date: Mon, 25 Feb 2008 22:54:57 +0000 (+0000)
Subject: MFB: Fixed bug #44242 (metaphone('CMXFXM') crashes PHP)
X-Git-Tag: BEFORE_NEW_PARAMETER_PARSE~743
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a9f5ad7e8772cd4c68b89b1d38526a16b0c0b65b;p=php

MFB: Fixed bug #44242 (metaphone('CMXFXM') crashes PHP)
---

diff --git a/ext/standard/metaphone.c b/ext/standard/metaphone.c
index e985b67a8b..34952d8295 100644
--- a/ext/standard/metaphone.c
+++ b/ext/standard/metaphone.c
@@ -150,7 +150,12 @@ static char Lookahead(char *word, int how_far)
 						(*phoned_word)[p_idx++] = c; \
 					}
 /* Slap a null character on the end of the phoned word */
-#define End_Phoned_Word	{(*phoned_word)[p_idx] = '\0';}
+#define End_Phoned_Word	{ \
+							if (p_idx == max_buffer_len) { \
+								*phoned_word = erealloc(*phoned_word, max_buffer_len + 1); \
+							} \
+							(*phoned_word)[p_idx] = '\0'; \
+						}
 /* How long is the phoned word? */
 #define Phone_Len	(p_idx)
 
diff --git a/ext/standard/tests/strings/bug44242.phpt b/ext/standard/tests/strings/bug44242.phpt
new file mode 100644
index 0000000000..00adda2be6
--- /dev/null
+++ b/ext/standard/tests/strings/bug44242.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #44242 (metaphone('CMXFXM') crashes PHP)
+--FILE--
+<?php
+
+echo metaphone('CMXFXZ'), "\n";
+echo metaphone('CMXFXV'), "\n";
+echo metaphone('CMXFXZXZ'), "\n";
+
+?>
+--EXPECT--
+KMKSFKSS
+KMKSFKSF
+KMKSFKSSKSS