From 80ea07d30c820f71eabdf31d47571d892e064df2 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Mon, 13 Mar 2006 14:37:10 +0000 Subject: [PATCH] Added overflow checks to wordwrap() function. --- NEWS | 1 + ext/standard/string.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index 0f77d95716..4f68751a54 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,7 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? Mar 2006, PHP 5.1.3RC2 +- Added overflow checks to wordwrap() function. (Ilia) - Removed the E_STRICT deprecation notice from "var". (Ilia) - Fixed debug_zval_dump() to support private and protected members. (Dmitry) - Fixed bug #36629 (SoapServer::handle() exits on SOAP faults). (Dmitry) diff --git a/ext/standard/string.c b/ext/standard/string.c index 5ae92eeec7..4f2897ce53 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -676,12 +676,13 @@ PHP_FUNCTION(wordwrap) /* Multiple character line break or forced cut */ if (linelength > 0) { chk = (int)(textlen/linelength + 1); + newtext = safe_emalloc(chk, breakcharlen, textlen + 1); alloced = textlen + chk * breakcharlen + 1; } else { chk = textlen; alloced = textlen * (breakcharlen + 1) + 1; + newtext = safe_emalloc(textlen, (breakcharlen + 1), 1); } - newtext = emalloc(alloced); /* now keep track of the actual new text length */ newtextlen = 0; -- 2.50.1