svn: /php/php-src/branches/PHP_5_2/ext/standard/ string.c

felipe Thu, 01 Jul 2010 19:51:36 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=300918 Log: - Fixed a possible memory corruption in substr(), chunk_split(), strtok(), addcslashes(), str_repeat() Changed paths: U php/php-src/branches/PHP_5_2/ext/standard/string.c Modified: php/php-src/branches/PHP_5_2/ext/standard/string.c =================================================================== --- php/php-src/branches/PHP_5_2/ext/standard/string.c 2010-07-01 19:11:01 UTC (rev 300917) +++ php/php-src/branches/PHP_5_2/ext/standard/string.c 2010-07-01 19:51:36 UTC (rev 300918) @@ -1230,6 +1230,9 @@ case 2: str = args[0]; tok = args[1]; + if (PZVAL_IS_REF(*str)) { + SEPARATE_ZVAL(str); + } convert_to_string_ex(str); zval_add_ref(str); @@ -2208,6 +2211,9 @@ WRONG_PARAM_COUNT; } + if (PZVAL_IS_REF(*p_str)) { + SEPARATE_ZVAL(p_str); + } convert_to_string_ex(p_str); if (argc > 1) { @@ -2263,6 +2269,9 @@ WRONG_PARAM_COUNT; } + if (PZVAL_IS_REF(*str)) { + SEPARATE_ZVAL(str); + } convert_to_string_ex(str); convert_to_long_ex(from); @@ -3059,6 +3068,9 @@ if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &str, &what) == FAILURE) { WRONG_PARAM_COUNT; } + if (PZVAL_IS_REF(*str)) { + SEPARATE_ZVAL(str); + } convert_to_string_ex(str); convert_to_string_ex(what); @@ -4632,6 +4644,9 @@ } /* Make sure we're dealing with proper types */ + if (PZVAL_IS_REF(*input_str)) { + SEPARATE_ZVAL(input_str); + } convert_to_string_ex(input_str); convert_to_long_ex(mult);