From b050f6e4309d0bc004d17a6ce753048619db52ae Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <iliaa@php.net>
Date: Thu, 31 Jul 2003 19:48:05 +0000
Subject: [PATCH] MFH: Fixed bug #22154 (Possible crash when memory_limit is
 reached and output buffering in addition to session.use_trans_sid is used).

---
 NEWS          |  4 ++++
 main/output.c | 23 +++++++++++++----------
 2 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/NEWS b/NEWS
index 5084b148a5..96045a4723 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,9 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+?? Aug 2003, Version 4.3.3RC3
+- Fixed bug #22154 (Possible crash when memory_limit is reached and
+  output buffering in addition to session.use_trans_sid is used). (Ilia)
+
 30 Jul 2003, Version 4.3.3RC2
 - Improved the NSAPI SAPI module (Uwe Schindler)
   . Added possibility to use PHP to generate HTTP error pages (404 Not Found..)
diff --git a/main/output.c b/main/output.c
index 0c327e9558..c029d32209 100644
--- a/main/output.c
+++ b/main/output.c
@@ -379,15 +379,20 @@ PHPAPI void php_ob_set_internal_handler(php_output_handler_func_t internal_outpu
 
 /* {{{ php_ob_allocate
  */
-static inline void php_ob_allocate(TSRMLS_D)
+static inline void php_ob_allocate(uint text_length TSRMLS_DC)
 {
-	if (OG(active_ob_buffer).size<OG(active_ob_buffer).text_length) {
-		while (OG(active_ob_buffer).size <= OG(active_ob_buffer).text_length) {
-			OG(active_ob_buffer).size+=OG(active_ob_buffer).block_size;
+	uint new_len = OG(active_ob_buffer).text_length + text_length;
+
+	if (OG(active_ob_buffer).size < new_len) {
+		uint buf_size = OG(active_ob_buffer).size;
+		while (buf_size <= new_len) {
+			buf_size += OG(active_ob_buffer).block_size;
 		}
-			
-		OG(active_ob_buffer).buffer = (char *) erealloc(OG(active_ob_buffer).buffer, OG(active_ob_buffer).size+1);
+
+		OG(active_ob_buffer).buffer = (char *) erealloc(OG(active_ob_buffer).buffer, buf_size+1);
+		OG(active_ob_buffer).size = buf_size;
 	}
+	OG(active_ob_buffer).text_length = new_len;
 }
 /* }}} */
 
@@ -592,9 +597,8 @@ static inline void php_ob_append(const char *text, uint text_length TSRMLS_DC)
 	int original_ob_text_length;
 
 	original_ob_text_length=OG(active_ob_buffer).text_length;
-	OG(active_ob_buffer).text_length = OG(active_ob_buffer).text_length + text_length;
 
-	php_ob_allocate(TSRMLS_C);
+	php_ob_allocate(text_length TSRMLS_CC);
 	target = OG(active_ob_buffer).buffer+original_ob_text_length;
 	memcpy(target, text, text_length);
 	target[text_length]=0;
@@ -619,8 +623,7 @@ static inline void php_ob_prepend(const char *text, uint text_length)
 	char *p, *start;
 	TSRMLS_FETCH();
 
-	OG(active_ob_buffer).text_length += text_length;
-	php_ob_allocate(TSRMLS_C);
+	php_ob_allocate(text_length TSRMLS_CC);
 
 	/* php_ob_allocate() may change OG(ob_buffer), so we can't initialize p&start earlier */
 	p = OG(ob_buffer)+OG(ob_text_length);
-- 
2.40.0