From cdb42ce6d288558fc984962a111659c9f8a59cfa Mon Sep 17 00:00:00 2001
From: Felipe Pena <felipe@php.net>
Date: Mon, 25 Feb 2008 22:56:47 +0000
Subject: [PATCH] MFB: Fixed bug #44242 (metaphone('CMXFXM') crashes PHP)

---
 ext/standard/metaphone.c                 |  7 ++++++-
 ext/standard/tests/strings/bug44242.phpt | 14 ++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/strings/bug44242.phpt

diff --git a/ext/standard/metaphone.c b/ext/standard/metaphone.c
index deb1df8bac..37e11ed0d7 100644
--- a/ext/standard/metaphone.c
+++ b/ext/standard/metaphone.c
@@ -151,7 +151,12 @@ static char Lookahead(char *word, int how_far) /* {{{ */
 						(*phoned_word)[p_idx++] = c; \
 					}
 /* Slap a null character on the end of the phoned word */
-#define End_Phoned_Word	{(*phoned_word)[p_idx] = '\0';}
+#define End_Phoned_Word	{ \
+							if (p_idx == max_buffer_len) { \
+								*phoned_word = erealloc(*phoned_word, max_buffer_len + 1); \
+							} \
+							(*phoned_word)[p_idx] = '\0'; \
+						}
 /* How long is the phoned word? */
 #define Phone_Len	(p_idx)
 
diff --git a/ext/standard/tests/strings/bug44242.phpt b/ext/standard/tests/strings/bug44242.phpt
new file mode 100644
index 0000000000..00adda2be6
--- /dev/null
+++ b/ext/standard/tests/strings/bug44242.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #44242 (metaphone('CMXFXM') crashes PHP)
+--FILE--
+<?php
+
+echo metaphone('CMXFXZ'), "\n";
+echo metaphone('CMXFXV'), "\n";
+echo metaphone('CMXFXZXZ'), "\n";
+
+?>
+--EXPECT--
+KMKSFKSS
+KMKSFKSF
+KMKSFKSSKSS
-- 
2.40.0