diff options
| author | Felipe Pena <felipe@php.net> | 2008-02-25 22:54:57 +0000 |
|---|---|---|
| committer | Felipe Pena <felipe@php.net> | 2008-02-25 22:54:57 +0000 |
| commit | a9f5ad7e8772cd4c68b89b1d38526a16b0c0b65b (patch) | |
| tree | 1db5ee368d60737b989759c13e4bcaf90c7a3a9e | |
| parent | f81134a9f298d5635ce38ae4950ee27dbbf30f74 (diff) | |
| download | php-git-a9f5ad7e8772cd4c68b89b1d38526a16b0c0b65b.tar.gz | |
MFB: Fixed bug #44242 (metaphone('CMXFXM') crashes PHP)
| -rw-r--r-- | ext/standard/metaphone.c | 7 | ||||
| -rw-r--r-- | ext/standard/tests/strings/bug44242.phpt | 14 |
2 files changed, 20 insertions, 1 deletions
diff --git a/ext/standard/metaphone.c b/ext/standard/metaphone.c index e985b67a8b..34952d8295 100644 --- a/ext/standard/metaphone.c +++ b/ext/standard/metaphone.c @@ -150,7 +150,12 @@ static char Lookahead(char *word, int how_far) (*phoned_word)[p_idx++] = c; \ } /* Slap a null character on the end of the phoned word */ -#define End_Phoned_Word {(*phoned_word)[p_idx] = '\0';} +#define End_Phoned_Word { \ + if (p_idx == max_buffer_len) { \ + *phoned_word = erealloc(*phoned_word, max_buffer_len + 1); \ + } \ + (*phoned_word)[p_idx] = '\0'; \ + } /* How long is the phoned word? */ #define Phone_Len (p_idx) diff --git a/ext/standard/tests/strings/bug44242.phpt b/ext/standard/tests/strings/bug44242.phpt new file mode 100644 index 0000000000..00adda2be6 --- /dev/null +++ b/ext/standard/tests/strings/bug44242.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #44242 (metaphone('CMXFXM') crashes PHP) +--FILE-- +<?php + +echo metaphone('CMXFXZ'), "\n"; +echo metaphone('CMXFXV'), "\n"; +echo metaphone('CMXFXZXZ'), "\n"; + +?> +--EXPECT-- +KMKSFKSS +KMKSFKSF +KMKSFKSSKSS |