diff options
| author | Dmitry Stogov <dmitry@zend.com> | 2015-10-08 14:30:43 +0300 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@zend.com> | 2015-10-08 14:30:43 +0300 |
| commit | 9af07e7119a150acd5911c97da5d91fe9e424570 (patch) | |
| tree | 36290ec51678b243a80b542752cf74ffee3ef89c | |
| parent | cc3c425af8c6a56a1b295ab335d0758f48dad284 (diff) | |
| download | php-git-9af07e7119a150acd5911c97da5d91fe9e424570.tar.gz | |
Fixed bug #70667 (strtr() causes invalid writes and a crashes)
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/standard/string.c | 2 | ||||
| -rw-r--r-- | ext/standard/tests/strings/bug70667.phpt | 9 |
3 files changed, 13 insertions, 1 deletions
@@ -16,6 +16,9 @@ PHP NEWS - Reflection: . Fixed bug #70650 (Wrong docblock assignment). (Marcio) +- Standard: + . Fixed bug #70667 (strtr() causes invalid writes and a crashes). (Dmitry) + 01 Oct 2015, PHP 7.0.0 RC 4 - Core: diff --git a/ext/standard/string.c b/ext/standard/string.c index 2200762dea..3d5b76caa2 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -3004,7 +3004,7 @@ static void php_strtr_array(zval *return_value, zend_string *input, HashTable *p zend_ulong *num_bitset; /* we will collect all possible key lengths */ - num_bitset = ecalloc((slen + (sizeof(zend_ulong)-1)) / sizeof(zend_ulong), sizeof(zend_ulong)); + num_bitset = ecalloc((slen + sizeof(zend_ulong)) / sizeof(zend_ulong), sizeof(zend_ulong)); memset(bitset, 0, sizeof(bitset)); /* check if original array has numeric keys */ diff --git a/ext/standard/tests/strings/bug70667.phpt b/ext/standard/tests/strings/bug70667.phpt new file mode 100644 index 0000000000..fd3deadb29 --- /dev/null +++ b/ext/standard/tests/strings/bug70667.phpt @@ -0,0 +1,9 @@ +--TEST-- +Bug #70667 (strtr() causes invalid writes and a crashes) +--FILE-- +<?php +$a = array("{{language_id}}"=>"255", "{{partner_name}}"=>"test1"); +var_dump(strtr("Sign in to test1", $a)); +?> +--EXPECT-- +string(16) "Sign in to test1" |