diff options
| author | Stanislav Malyshev <stas@php.net> | 2014-05-11 18:15:29 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2014-05-11 18:16:19 -0700 |
| commit | af5cc61cf374f3700872c989cfdf8e197248c57c (patch) | |
| tree | b999bcdc3e341696f70806098fe42fd28b84acf2 /ext/spl/spl_fixedarray.c | |
| parent | 291b45afb5d5716ff0d340bd2bcb34731b806eed (diff) | |
| parent | 2b475eebbea85779989e98e87753d6b023a1d131 (diff) | |
| download | php-git-af5cc61cf374f3700872c989cfdf8e197248c57c.tar.gz | |
Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
Fix bug #67247 spl_fixedarray_resize integer overflow
fix news
Diffstat (limited to 'ext/spl/spl_fixedarray.c')
| -rw-r--r-- | ext/spl/spl_fixedarray.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ext/spl/spl_fixedarray.c b/ext/spl/spl_fixedarray.c index ca61b3bd97..98a5117eff 100644 --- a/ext/spl/spl_fixedarray.c +++ b/ext/spl/spl_fixedarray.c @@ -116,7 +116,7 @@ static void spl_fixedarray_resize(spl_fixedarray *array, long size TSRMLS_DC) /* array->elements = NULL; } } else if (size > array->size) { - array->elements = erealloc(array->elements, sizeof(zval *) * size); + array->elements = safe_erealloc(array->elements, size, sizeof(zval *), 0); memset(array->elements + array->size, '\0', sizeof(zval *) * (size - array->size)); } else { /* size < array->size */ long i; |