Merge branch 'PHP-7.4' into PHP-8.0

cmb69 · cmb69 · commit c6b7f6c39f53 · 2021-07-15T15:29:48.000+02:00
* PHP-7.4:
  Fix #72595: php_output_handler_append illegal write access
diff --git a/NEWS b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2021, PHP 8.0.10
 
+- Core:
+  . Fixed bug #72595 (php_output_handler_append illegal write access). (cmb)
+
 - Standard:
   . Fixed bug #72146 (Integer overflow on substr_replace). (cmb)
 
diff --git a/main/output.c b/main/output.c
@@ -896,7 +896,7 @@ static inline int php_output_handler_append(php_output_handler *handler, const p
 			size_t grow_buf = PHP_OUTPUT_HANDLER_INITBUF_SIZE(buf->used - (handler->buffer.size - handler->buffer.used));
 			size_t grow_max = MAX(grow_int, grow_buf);
 
-			handler->buffer.data = erealloc(handler->buffer.data, handler->buffer.size + grow_max);
+			handler->buffer.data = safe_erealloc(handler->buffer.data, 1, handler->buffer.size, grow_max);
 			handler->buffer.size += grow_max;
 		}
 		memcpy(handler->buffer.data + handler->buffer.used, buf->data, buf->used);

Original file line number	Diff line number	Diff line change
`@@ -896,7 +896,7 @@ static inline int php_output_handler_append(php_output_handler *handler, const p`
`896`	`896`	`size_t grow_buf = PHP_OUTPUT_HANDLER_INITBUF_SIZE(buf->used - (handler->buffer.size - handler->buffer.used));`
`897`	`897`	`size_t grow_max = MAX(grow_int, grow_buf);`
`898`	`898`
`899`		`- handler->buffer.data = erealloc(handler->buffer.data, handler->buffer.size + grow_max);`
	`899`	`+ handler->buffer.data = safe_erealloc(handler->buffer.data, 1, handler->buffer.size, grow_max);`
`900`	`900`	`handler->buffer.size += grow_max;`
`901`	`901`	`}`
`902`	`902`	`memcpy(handler->buffer.data + handler->buffer.used, buf->data, buf->used);`