From: Gustavo Lopes <glopes@nebm.ist.utl.pt>
Date: Fri, 2 Nov 2012 16:53:48 +0000 (+0100)
Subject: Fix bug in from_zval_write_control_array()
X-Git-Tag: php-5.5.0alpha5~43^2~11^2~26
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b27c22d627e342687eb0c21bac8859ea1d91b54b;p=php

Fix bug in from_zval_write_control_array()
---

diff --git a/ext/sockets/sendrecvmsg.c b/ext/sockets/sendrecvmsg.c
index 837ae23735..0489e977be 100644
--- a/ext/sockets/sendrecvmsg.c
+++ b/ext/sockets/sendrecvmsg.c
@@ -792,7 +792,7 @@ static void from_zval_write_control_array(const zval *arr, char *msghdr_c, ser_c
     }
 
     msg->msg_control = control_buf;
-    msg->msg_controllen = control_len;
+    msg->msg_controllen = cur_offset; /* not control_len, which may be larger */
 }
 static void to_zval_read_cmsg_data(const char *cmsghdr_c, zval *zv, res_context *ctx)
 {