Merge branch 'PHP-7.0' into PHP-7.1

cmb69 · cmb69 · commit 5d394b3bb4b6 · 2016-09-06T12:16:42.000+02:00
diff --git a/NEWS b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2016, PHP 7.1.0RC2
 
+- Core:
+  . Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of
+    zend_virtual_cwd.c). (cmb)
+
 - Filter:
   . Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
     FILTER_FLAG_NO_PRIV_RANGE). (julien)
diff --git a/Zend/zend_virtual_cwd.c b/Zend/zend_virtual_cwd.c
@@ -1925,7 +1925,7 @@ CWD_API FILE *virtual_popen(const char *command, const char *type) /* {{{ */
 #else /* Unix */
 CWD_API FILE *virtual_popen(const char *command, const char *type) /* {{{ */
 {
-	int command_length;
+	size_t command_length;
 	int dir_length, extra = 0;
 	char *command_line;
 	char *ptr, *dir;

Original file line number	Diff line number	Diff line change
`@@ -1925,7 +1925,7 @@ CWD_API FILE virtual_popen(const char command, const char type) / {{{ */`
`1925`	`1925`	`#else /* Unix */`
`1926`	`1926`	`CWD_API FILE virtual_popen(const char command, const char type) / {{{ */`
`1927`	`1927`	`{`
`1928`		`- int command_length;`
	`1928`	`+ size_t command_length;`
`1929`	`1929`	`int dir_length, extra = 0;`
`1930`	`1930`	`char *command_line;`
`1931`	`1931`	`char ptr, dir;`