Skip to content

Commit 5f504f1

Browse files
committed
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2: Fix GH-15628: php_stream_memory_get_buffer() not zero-terminated
2 parents 9cb23a3 + 93021c6 commit 5f504f1

File tree

2 files changed

+6
-0
lines changed

2 files changed

+6
-0
lines changed

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ PHP NEWS
2727
. Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb,
2828
Kamil Tekiela)
2929

30+
- Streams:
31+
. Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
32+
(cmb)
33+
3034
29 Aug 2024, PHP 8.3.11
3135

3236
- Core:

main/streams/memory.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ static ssize_t php_stream_memory_write(php_stream *stream, const char *buf, size
6666
if (count) {
6767
ZEND_ASSERT(buf != NULL);
6868
memcpy(ZSTR_VAL(ms->data) + ms->fpos, (char*) buf, count);
69+
ZSTR_VAL(ms->data)[ZSTR_LEN(ms->data)] = '\0';
6970
ms->fpos += count;
7071
}
7172
return count;
@@ -241,6 +242,7 @@ static int php_stream_memory_set_option(php_stream *stream, int option, int valu
241242
size_t old_size = ZSTR_LEN(ms->data);
242243
ms->data = zend_string_realloc(ms->data, newsize, 0);
243244
memset(ZSTR_VAL(ms->data) + old_size, 0, newsize - old_size);
245+
ZSTR_VAL(ms->data)[ZSTR_LEN(ms->data)] = '\0';
244246
}
245247
return PHP_STREAM_OPTION_RETURN_OK;
246248
}

0 commit comments

Comments
 (0)