com php-src: Fixed #73496 (Invalid memory access in zend_inline_hash_func): NEWS main/streams/filter .c

[email protected] (Xinchen Hui)
Newsgroups php.cvs
Message-ID <[email protected]>
Commit:    ee25eb0eae52a942c914b997c14d9558be76ee88
Author:    Xinchen Hui <[email protected]>         Sun, 12 Feb 2017 18:55:19 +0800
Parents:   981c58705ada3f645232afa490ac334bc27306ae
Branches:  PHP-7.0 PHP-7.1 master

Link:       http://git.php.net/?p=php-src.git;a=commitdiff;h=ee25eb0eae52a942c914b997c14d9558be76ee88

Log:
Fixed #73496 (Invalid memory access in zend_inline_hash_func)

no test script is added because it requre too much memory

Bugs:
https://bugs.php.net/73496

Changed paths:
  M  NEWS
  M  main/streams/filter.c


Diff:
diff --git a/NEWS b/NEWS
index f78594b..72c0b09 100644
--- a/NEWS
+++ b/NEWS
@@ -39,6 +39,10 @@ PHP                                                                        NEWS
   . Fixed bug #73118 (is_callable callable name reports misleading value for
     anonymous classes). (Adam Saponara)
 
+- Streams:
+  . Fixed bug #73496 (Invalid memory access in zend_inline_hash_func).
+    (Laruence)
+
 
 16 Feb 2017 PHP 7.0.16
 
diff --git a/main/streams/filter.c b/main/streams/filter.c
index ecb4f59..6d38869 100644
--- a/main/streams/filter.c
+++ b/main/streams/filter.c
@@ -252,10 +252,10 @@ PHPAPI php_stream_filter *php_stream_filter_create(const char *filtername, zval
 	HashTable *filter_hash = (FG(stream_filters) ? FG(stream_filters) : &stream_filters_hash);
 	php_stream_filter_factory *factory = NULL;
 	php_stream_filter *filter = NULL;
-	int n;
+	size_t n;
 	char *period;
 
-	n = (int)strlen(filtername);
+	n = strlen(filtername);
 
 	if (NULL != (factory = zend_hash_str_find_ptr(filter_hash, filtername, n))) {
 		filter = factory->create_filter(filtername, filterparams, persistent);
@@ -263,7 +263,7 @@ PHPAPI php_stream_filter *php_stream_filter_create(const char *filtername, zval
 		/* try a wildcard */
 		char *wildname;
 
-		wildname = emalloc(n+3);
+		wildname = safe_emalloc(1, n, 3);
 		memcpy(wildname, filtername, n+1);
 		period = wildname + (period - filtername);
 		while (period && !filter) {
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.