diff options
| author | Dmitry Stogov <dmitry@php.net> | 2006-05-25 06:40:21 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2006-05-25 06:40:21 +0000 |
| commit | 4516e20a39ceaac43142a7cf0b348bcc2e5ee474 (patch) | |
| tree | 81350e4b605174d6ad0dfce0cb46bac49b2c1a41 | |
| parent | 3067c75e5e2ba2834a76687598dddb97c3e41517 (diff) | |
| download | php-git-4516e20a39ceaac43142a7cf0b348bcc2e5ee474.tar.gz | |
Fixed bug #37496 (FastCGI output buffer overrun)
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | sapi/cgi/fastcgi.c | 7 |
2 files changed, 6 insertions, 2 deletions
@@ -1,6 +1,7 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2006, PHP 5.?.? +- Fixed bug #37496 (FastCGI output buffer overrun). (Piotr, Dmitry) - Fixed bug #37487 (oci_fetch_array() array-type should always default to OCI_BOTH). (Tony) - Fixed bug #37416 (iterator_to_array() hides exceptions thrown in rewind() diff --git a/sapi/cgi/fastcgi.c b/sapi/cgi/fastcgi.c index 46fc511006..865ed09009 100644 --- a/sapi/cgi/fastcgi.c +++ b/sapi/cgi/fastcgi.c @@ -803,6 +803,7 @@ int fcgi_write(fcgi_request *req, fcgi_request_type type, const char *str, int l limit = sizeof(req->out_buf) - (req->out_pos - req->out_buf); if (!req->out_hdr) { limit -= sizeof(fcgi_header); + if (limit < 0) limit = 0; } if (len < limit) { @@ -815,8 +816,10 @@ int fcgi_write(fcgi_request *req, fcgi_request_type type, const char *str, int l if (!req->out_hdr) { open_packet(req, type); } - memcpy(req->out_pos, str, limit); - req->out_pos += limit; + if (limit > 0) { + memcpy(req->out_pos, str, limit); + req->out_pos += limit; + } if (!fcgi_flush(req, 0)) { return -1; } |