From: Thies C. Arntzen <thies@php.net>
Date: Fri, 19 Nov 1999 14:11:15 +0000 (+0000)
Subject: @- Fixed mem-overwrite in XML_Parse_Into_Struct. (Thies)
X-Git-Tag: ZEND_OPTIMIZER_B1~33
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b712c9360d66b92fcf7a24a5d1be391eb27495e1;p=php

@- Fixed mem-overwrite in XML_Parse_Into_Struct. (Thies)
(PHP xml_parse_into_struct) buffer was sometimes short by 1.
---

diff --git a/ext/xml/xml.c b/ext/xml/xml.c
index bfcc14b403..4afbf30f3e 100644
--- a/ext/xml/xml.c
+++ b/ext/xml/xml.c
@@ -819,7 +819,7 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
 					/* check if the current tag already has a value - if yes append to that! */
 					if (zend_hash_find((*parser->ctag)->value.ht,"value",sizeof("value"),(void **) &myval) == SUCCESS) {
 						int newlen = (*myval)->value.str.len + decoded_len;
-						(*myval)->value.str.val = erealloc((*myval)->value.str.val,newlen);
+						(*myval)->value.str.val = erealloc((*myval)->value.str.val,newlen+1);
 						strcpy((*myval)->value.str.val + (*myval)->value.str.len,decoded_value);
 						(*myval)->value.str.len += decoded_len;
 						efree(decoded_value);