From: Dmitry Stogov <dmitry@php.net>
Date: Mon, 25 Apr 2005 06:11:00 +0000 (+0000)
Subject: Fixed call to estrndup() with invalid lengt
X-Git-Tag: php-5.0.5RC1~383
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=abe7b677f3d204d277b7ded61d50ddd116f3056b;p=php

Fixed call to estrndup() with invalid lengt
---

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 065c9b4680..0c668ee20d 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -1054,7 +1054,7 @@ ZEND_API int zend_hash_get_current_key_ex(HashTable *ht, char **str_index, uint
 	if (p) {
 		if (p->nKeyLength) {
 			if (duplicate) {
-				*str_index = estrndup(p->arKey, p->nKeyLength);
+				*str_index = estrndup(p->arKey, p->nKeyLength-1);
 			} else {
 				*str_index = p->arKey;
 			}
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 01d62f23c4..d2ed1c7eff 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -669,7 +669,7 @@ static int array_user_key_compare(const void *a, const void *b TSRMLS_DC)
 	s = *((Bucket **) b);
 
 	if (f->nKeyLength) {
-		Z_STRVAL(key1) = estrndup(f->arKey, f->nKeyLength);
+		Z_STRVAL(key1) = estrndup(f->arKey, f->nKeyLength-1);
 		Z_STRLEN(key1) = f->nKeyLength-1;
 		Z_TYPE(key1) = IS_STRING;
 	} else {
@@ -677,7 +677,7 @@ static int array_user_key_compare(const void *a, const void *b TSRMLS_DC)
 		Z_TYPE(key1) = IS_LONG;
 	}
 	if (s->nKeyLength) {
-		Z_STRVAL(key2) = estrndup(s->arKey, s->nKeyLength);
+		Z_STRVAL(key2) = estrndup(s->arKey, s->nKeyLength-1);
 		Z_STRLEN(key2) = s->nKeyLength-1;
 		Z_TYPE(key2) = IS_STRING;
 	} else {
@@ -2715,7 +2715,7 @@ PHP_FUNCTION(array_change_key_case)
 				zend_hash_index_update(Z_ARRVAL_P(return_value), num_key, entry, sizeof(entry), NULL);
 				break;
 			case HASH_KEY_IS_STRING:
-				new_key=estrndup(string_key,str_key_len);
+				new_key=estrndup(string_key,str_key_len - 1);
 				if (change_to_upper)
 					php_strtoupper(new_key, str_key_len - 1);
 				else