com php-src: Merge branch 'PHP-5.6' into PHP-7.0: ext/imap/php _imap.c ext/intl/intl_convert.c ext/intl/locale/loc ale_methods.c
ext/intl/msgformat/msgformat_data.c e xt/zip/php_zip.c

Commit: 6e12e49b5be06b4346e3d7802ea9b09f9f1abd7b Author: Stanislav Malyshev <stas@php.net> Thu, 3 Nov 2016 20:45:13 -0700 Parents: 7f2b7a4950bf30e6a13e89456275f53e5b66eb1f ea9fac94bbae150a81fde0e6542e6b45965772cd Branches: PHP-7.0 PHP-7.1 master Link: http://git.php..net/?p=php-src.git;a=commitdiff;h=6e12e49b5be06b4346e3d7802ea9b09f9f1abd7b Log: Merge branch 'PHP-5.6' into PHP-7.0 * PHP-5.6: More string length checks & fixes Changed paths: MM ext/imap/php_imap.c MM ext/intl/intl_convert.c MM ext/intl/locale/locale_methods.c MM ext/intl/msgformat/msgformat_data.c MM ext/zip/php_zip.c Diff: diff --cc ext/intl/locale/locale_methods.c index 18a051f,39d80d5..12cf6c1 --- a/ext/intl/locale/locale_methods.c +++ b/ext/intl/locale/locale_methods.c @@@ -713,8 -705,10 +716,10 @@@ PHP_FUNCTION( locale_get_keywords RETURN_FALSE; } + INTL_CHECK_LOCALE_LEN(strlen(loc_name)); + if(loc_name_len == 0) { - loc_name = intl_locale_get_default(TSRMLS_C); + loc_name = intl_locale_get_default(); } /* Get the keywords */ @@@ -1120,8 -1114,10 +1125,10 @@@ PHP_FUNCTION(locale_parse RETURN_FALSE; } + INTL_CHECK_LOCALE_LEN(strlen(loc_name)); + if(loc_name_len == 0) { - loc_name = intl_locale_get_default(TSRMLS_C); + loc_name = intl_locale_get_default(); } array_init( return_value ); diff --cc ext/zip/php_zip.c index cfac566,9f2b376..473e231 --- a/ext/zip/php_zip.c +++ b/ext/zip/php_zip.c @@@ -1803,19 -1913,19 +1803,19 @@@ static ZIPARCHIVE_METHOD(addFromString return; } - ze_obj = (ze_zip_object*) zend_object_store_get_object(this TSRMLS_CC); + ze_obj = Z_ZIP_P(self); if (ze_obj->buffers_cnt) { - ze_obj->buffers = (char **)erealloc(ze_obj->buffers, sizeof(char *) * (ze_obj->buffers_cnt+1)); + ze_obj->buffers = (char **)safe_erealloc(ze_obj->buffers, sizeof(char *), (ze_obj->buffers_cnt+1), 0); pos = ze_obj->buffers_cnt++; } else { ze_obj->buffers = (char **)emalloc(sizeof(char *)); ze_obj->buffers_cnt++; pos = 0; } - ze_obj->buffers[pos] = (char *)emalloc(ZSTR_LEN(buffer) + 1); - ze_obj->buffers[pos] = (char *)safe_emalloc(buffer_len, 1, 1); - memcpy(ze_obj->buffers[pos], buffer, buffer_len + 1); ++ ze_obj->buffers[pos] = (char *)safe_emalloc(ZSTR_LEN(buffer), 1, 1); + memcpy(ze_obj->buffers[pos], ZSTR_VAL(buffer), ZSTR_LEN(buffer) + 1); - zs = zip_source_buffer(intern, ze_obj->buffers[pos], buffer_len, 0); + zs = zip_source_buffer(intern, ze_obj->buffers[pos], ZSTR_LEN(buffer), 0); if (zs == NULL) { RETURN_FALSE;