[PATCH] fix for bug #23162
| From: | Moriyoshi Koizumi | Date: | Fri, 02 May 2003 22:27:47 +0000 |
| Subject: | [PATCH] fix for bug #23162 | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-1184@lists.php.net to get a copy of this message | ||
Hi,
The attached patch is the fix for bug #23162.
Could anyone with ZE karma apply this one? or decide to offer me a karma
for my bug fixing by myself..
Moriyoshi
Index: Zend/zend.c =================================================================== RCS file: /repository/Zend/zend.c,v retrieving revision 1.162.2.2 diff -u -r1.162.2.2 zend.c --- Zend/zend.c 31 Dec 2002 16:22:56 -0000 1.162.2.2 +++ Zend/zend.c 2 May 2003 22:17:45 -0000 @@ -754,11 +754,14 @@ #ifdef HAVE_VSNPRINTF z_error_message->value.str.len = vsnprintf(z_error_message->value.str.val, ZEND_ERROR_BUFFER_SIZE, format, args); - if (z_error_message->value.str.len > ZEND_ERROR_BUFFER_SIZE-1) { + if (z_error_message->value.str.len < 0 || z_error_message->value.str.len > ZEND_ERROR_BUFFER_SIZE-1) { + z_error_message->value.str.val[ZEND_ERROR_BUFFER_SIZE-1] = '\0'; z_error_message->value.str.len = ZEND_ERROR_BUFFER_SIZE-1; } #else - strncpy(z_error_message->value.str.val, format, ZEND_ERROR_BUFFER_SIZE); + strncpy(z_error_message->value.str.val, va_arg(format, char *), ZEND_ERROR_BUFFER_SIZE); + z_error_message->value.str.val[ZEND_ERROR_BUFFER_SIZE - 1] = '\0'; + z_error_message->value.str.len = strlen(z_error_message->value.str.val); /* This is risky... */ /* z_error_message->value.str.len = vsprintf(z_error_message->value.str.val, format, args); */ #endif @@ -778,7 +781,8 @@ z_context->value.ht = EG(active_symbol_table); z_context->type = IS_ARRAY; - ZVAL_ADDREF(z_context); /* we don't want this one to be freed */ + z_context->is_ref = 1; + z_context->refcount = 2; /* we don't want this one to be freed */ params = (zval ***) emalloc(sizeof(zval **)*5); params[0] = &z_error_type;
Index: Zend/zend.c =================================================================== RCS file: /repository/Zend/zend.c,v retrieving revision 1.162.2.2 diff -u -r1.162.2.2 zend.c --- Zend/zend.c 31 Dec 2002 16:22:56 -0000 1.162.2.2 +++ Zend/zend.c 2 May 2003 22:17:45 -0000 @@ -754,11 +754,14 @@ #ifdef HAVE_VSNPRINTF z_error_message->value.str.len = vsnprintf(z_error_message->value.str.val, ZEND_ERROR_BUFFER_SIZE, format, args); - if (z_error_message->value.str.len > ZEND_ERROR_BUFFER_SIZE-1) { + if (z_error_message->value.str.len < 0 || z_error_message->value.str.len > ZEND_ERROR_BUFFER_SIZE-1) { + z_error_message->value.str.val[ZEND_ERROR_BUFFER_SIZE-1] = '\0'; z_error_message->value.str.len = ZEND_ERROR_BUFFER_SIZE-1; } #else - strncpy(z_error_message->value.str.val, format, ZEND_ERROR_BUFFER_SIZE); + strncpy(z_error_message->value.str.val, va_arg(format, char *), ZEND_ERROR_BUFFER_SIZE); + z_error_message->value.str.val[ZEND_ERROR_BUFFER_SIZE - 1] = '\0'; + z_error_message->value.str.len = strlen(z_error_message->value.str.val); /* This is risky... */ /* z_error_message->value.str.len = vsprintf(z_error_message->value.str.val, format, args); */ #endif @@ -778,7 +781,8 @@ z_context->value.ht = EG(active_symbol_table); z_context->type = IS_ARRAY; - ZVAL_ADDREF(z_context); /* we don't want this one to be freed */ + z_context->is_ref = 1; + z_context->refcount = 2; /* we don't want this one to be freed */ params = (zval ***) emalloc(sizeof(zval **)*5); params[0] = &z_error_type;