Re: Segmentation fault in html_entity_decode
| From: | Kamesh Jayachandran | Date: | Wed, 12 Jan 2005 07:31:30 +0000 |
| Subject: | Re: Segmentation fault in html_entity_decode | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-14350@lists.php.net to get a copy of this message | ||
Hi Moriyoshi,
Still ent_uni_8592_9002's actual size is 410 but accessed with a index
410.
With regards
Kamesh Jayachandran
On Wed, 12 Jan 2005 05:51:01 +0900, "Moriyoshi Koizumi"
<moriyoshi@at.wakwak.com> said:
> Now fixed in CVS. Thanks for the good report.
>
> Moriyoshi
>
> On 2005/01/10, at 22:30, Kamesh Jayachandran wrote:
>
> > Hi All,
> > The following script causes a segmentation fault in NetWare but not on
> > Windows or Linux versions of php-5.0.3
> > <?php
> > html_entity_decode(' ', ENT_QUOTES, 'UTF-8');
> > ?>
> >
> > I can not attribute to NetWare instead I could see the defect in our
> > ext/standard/html.c
> > The cause seems to be the following arrays are accessed with a index
> > that is beyond their size
> > 1)ent_uni_spacing(Actual size is 22 but accessed with a index 22)
> > 2)ent_uni_8592_9002(Actual size is 410 but accessed with a index 410.
> > From the name it seems that 9002 is a valid index so we need to add one
> > more NULL at the end)
> > Either we should add one more entry to the ent_uni_spacing array or
> > reduce our endchar in entity_map
> > You can see the index with which this arrays are accessed by putting a
> > printf("k - entity_map[j].basechar = %d\n", k -
> > entity_map[j].basechar);
> > in a for loop which is around line 898 in html.c version 1.97.2.1.
>