Browse Source

invalid read of 2 bytes in hashtable

git-svn-id: svn://svn.lighttpd.net/xcache/trunk@1495 c26eb9a1-5813-0410-bd6c-c2e55f420ca7
master
Xuefer 6 years ago
parent
commit
f5e6898b1b
2 changed files with 3 additions and 3 deletions
  1. +2
    -2
      mod_disassembler/xc_disassembler.c
  2. +1
    -1
      processor/hashtable.m4

+ 2
- 2
mod_disassembler/xc_disassembler.c View File

@@ -48,7 +48,7 @@ static void xc_dasm(zval *output, zend_op_array *op_array TSRMLS_DC) /* {{{ */
} while (keysize > bufsize);
buf = erealloc(buf, bufsize);
}
memcpy(buf, BUCKET_KEY_S(b), keysize);
memcpy(buf, BUCKET_KEY_S(b), keysize - 2);
buf[keysize - 2] = buf[keysize - 1] = ""[0];
keyLength = b->nKeyLength;
#ifdef IS_UNICODE
@@ -84,7 +84,7 @@ static void xc_dasm(zval *output, zend_op_array *op_array TSRMLS_DC) /* {{{ */
} while (keysize > bufsize);
buf = erealloc(buf, bufsize);
}
memcpy(buf, BUCKET_KEY_S(b), keysize);
memcpy(buf, BUCKET_KEY_S(b), keysize - 2);
buf[keysize - 2] = buf[keysize - 1] = ""[0];
keyLength = b->nKeyLength;
#ifdef IS_UNICODE


+ 1
- 1
processor/hashtable.m4 View File

@@ -24,7 +24,7 @@ define(`DEF_HASH_TABLE_FUNC', `DEF_STRUCT_P_FUNC(`HashTable', `$1', `
} while (keysize > bufsize);
buf = erealloc(buf, bufsize);
}
memcpy(buf, BUCKET_KEY_S(srcBucket), keysize);
memcpy(buf, BUCKET_KEY_S(srcBucket), keysize - 2);
buf[keysize - 2] = buf[keysize - 1] = ""[0];
keysize = srcBucket->nKeyLength;
#ifdef IS_UNICODE


Loading…
Cancel
Save