php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-29 19:52:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix off-by-one bug in text messages (msg/<phpdbg>)

Browse Source
This commit is contained in:
Bob Weinand
2014-10-20 21:52:47 +02:00
parent 27629577b0
commit dfdc19fb2a
1 changed files with 2 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
phpdbg_utils.c
View File

@@ -1094,7 +1094,7 @@ static int phpdbg_encode_xml(char **buf, char *msg, int msglen, int from, char *
int i;
int tolen = to ? strlen(to) : 5;
char *tmp = *buf = emalloc(msglen * tolen);
for (i = 0; ++i < msglen; msg++) {
for (i = 0; i++ < msglen; msg++) {
if (*msg == '&') {
memcpy(tmp, ZEND_STRL("&amp;"));
tmp += sizeof("&amp;") - 1;
@@ -1118,20 +1118,17 @@ static int phpdbg_encode_xml(char **buf, char *msg, int msglen, int from, char *
static void phpdbg_encode_ctrl_chars(char **buf, int *buflen) {
char *tmp, *tmpptr;
int len = *buflen;
int len;
int i;
tmp = tmpptr = emalloc(*buflen * 5);
for (i = 0; i < *buflen; i++) {
if ((*buf)[i] < 0x20) {
len += 4;
*tmpptr++ = '&';
*tmpptr++ = '#';
if ((unsigned int) ((*buf)[i]) > 9) {
*tmpptr++ = ((*buf)[i] / 10) + '0';
} else {
--len;
}
*tmpptr++ = ((*buf)[i] % 10) + '0';
*tmpptr++ = ';';