From: Greg Beaver <cellog@php.net>
Date: Sat, 13 Jun 2009 17:35:37 +0000 (+0000)
Subject: fix missing erealloc in fix for bug #40091, spl_autoload_register of more than 1... 
X-Git-Tag: php-5.2.10~24
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=aac2b9464d49c10c2fe26cbdf59a5c1978cdd7c0;p=php

fix missing erealloc in fix for bug #40091, spl_autoload_register of more than 1 copy of the same method in different objects
---

diff --git a/NEWS b/NEWS
index 9fe3e5323c..384fc41c48 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? Jun 2009, PHP 5.2.10
 - Fixed bug #48514 (cURL extension uses same resource name for simple and
   multi APIs). (Felipe)
+- Fixed missing erealloc() in fix for Bug #40091 in spl_autoload_register.
+  (Greg)
 
 11 Jun 2009, PHP 5.2.10RC2
 - Updated timezone database to version 2009.9 (2009i) (Derick)
diff --git a/ext/spl/php_spl.c b/ext/spl/php_spl.c
index bf049368f9..eddb16f041 100755
--- a/ext/spl/php_spl.c
+++ b/ext/spl/php_spl.c
@@ -464,6 +464,7 @@ PHP_FUNCTION(spl_autoload_register)
 
 		if (obj_ptr && !(alfi.func_ptr->common.fn_flags & ZEND_ACC_STATIC)) {
 			/* add object id to the hash to ensure uniqueness, for more reference look at bug #40091 */
+			lc_name = erealloc(lc_name, func_name_len + 2 + sizeof(zend_object_handle));
 			memcpy(lc_name + func_name_len, &Z_OBJ_HANDLE_PP(obj_ptr), sizeof(zend_object_handle));
 			func_name_len += sizeof(zend_object_handle);
 			lc_name[func_name_len] = '\0';