From: Dmitry Stogov <dmitry@php.net>
Date: Fri, 1 Dec 2006 14:57:44 +0000 (+0000)
Subject: Fixed buffer overflow. (Rob)
X-Git-Tag: RELEASE_1_0_0RC1~862
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bea2519575dddbcf144e7df5ef8a128ba077b2e3;p=php

Fixed buffer overflow. (Rob)
---

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 418a1ede04..83ca2e8266 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -3016,7 +3016,7 @@ ZEND_API int zend_declare_property_ex(zend_class_entry *ce, char *name, int name
 		zstr uname;
 		int ret;
 
-		uname.u = do_alloca(name_length+1);
+		uname.u = do_alloca(UBYTES(name_length+1));
 		u_charsToUChars(name, uname.u, name_length+1);
 		ret = zend_u_declare_property_ex(ce, IS_UNICODE, uname, name_length, property, access_type, doc_comment, doc_comment_len TSRMLS_CC);
 		free_alloca(uname.u);
@@ -3037,7 +3037,7 @@ ZEND_API int zend_declare_property(zend_class_entry *ce, char *name, int name_le
 		zstr uname;
 		int ret;
 
-		uname.u = do_alloca(name_length+1);
+		uname.u = do_alloca(UBYTES(name_length+1));
 		u_charsToUChars(name, uname.u, name_length+1);
 		ret = zend_u_declare_property_ex(ce, IS_UNICODE, uname, name_length, property, access_type, NULL_ZSTR, 0 TSRMLS_CC);
 		free_alloca(uname.u);