From 9b730870a118b7ebb59c7cae7b92e940b86dd01f Mon Sep 17 00:00:00 2001 From: Felipe Pena Date: Mon, 25 Feb 2008 22:40:45 +0000 Subject: [PATCH] Fixed bug #44242 (metaphone(CMXFXM) crashes PHP) --- NEWS | 1 + ext/standard/metaphone.c | 7 ++++++- ext/standard/tests/strings/bug44242.phpt | 14 ++++++++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 ext/standard/tests/strings/bug44242.phpt diff --git a/NEWS b/NEWS index 52b68a9972..66eee29360 100644 --- a/NEWS +++ b/NEWS @@ -13,6 +13,7 @@ PHP NEWS - Upgraded PCRE to version 7.6 (Nuno) +- Fixed bug #44242 (metaphone('CMXFXM') crashes PHP). (Felipe) - Fixed bug #44216 (strftime segfaults on large negative value). (Derick) - Fixed bug #44200 (A crash in PDO when no bound targets exists and yet bound parameters are present). (Ilia) diff --git a/ext/standard/metaphone.c b/ext/standard/metaphone.c index e985b67a8b..34952d8295 100644 --- a/ext/standard/metaphone.c +++ b/ext/standard/metaphone.c @@ -150,7 +150,12 @@ static char Lookahead(char *word, int how_far) (*phoned_word)[p_idx++] = c; \ } /* Slap a null character on the end of the phoned word */ -#define End_Phoned_Word {(*phoned_word)[p_idx] = '\0';} +#define End_Phoned_Word { \ + if (p_idx == max_buffer_len) { \ + *phoned_word = erealloc(*phoned_word, max_buffer_len + 1); \ + } \ + (*phoned_word)[p_idx] = '\0'; \ + } /* How long is the phoned word? */ #define Phone_Len (p_idx) diff --git a/ext/standard/tests/strings/bug44242.phpt b/ext/standard/tests/strings/bug44242.phpt new file mode 100644 index 0000000000..00adda2be6 --- /dev/null +++ b/ext/standard/tests/strings/bug44242.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #44242 (metaphone('CMXFXM') crashes PHP) +--FILE-- + +--EXPECT-- +KMKSFKSS +KMKSFKSF +KMKSFKSSKSS -- 2.50.1