diff --git a/NEWS b/NEWS index bb597215fb6..2ef2439917e 100644 --- a/NEWS +++ b/NEWS @@ -27,6 +27,10 @@ PHP NEWS . Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb, Kamil Tekiela) +- Streams: + . Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated). + (cmb) + 29 Aug 2024, PHP 8.3.11 - Core: diff --git a/main/streams/memory.c b/main/streams/memory.c index 62d36906635..ce11aec382b 100644 --- a/main/streams/memory.c +++ b/main/streams/memory.c @@ -66,6 +66,7 @@ static ssize_t php_stream_memory_write(php_stream *stream, const char *buf, size if (count) { ZEND_ASSERT(buf != NULL); memcpy(ZSTR_VAL(ms->data) + ms->fpos, (char*) buf, count); + ZSTR_VAL(ms->data)[ZSTR_LEN(ms->data)] = '\0'; ms->fpos += count; } return count; @@ -241,6 +242,7 @@ static int php_stream_memory_set_option(php_stream *stream, int option, int valu size_t old_size = ZSTR_LEN(ms->data); ms->data = zend_string_realloc(ms->data, newsize, 0); memset(ZSTR_VAL(ms->data) + old_size, 0, newsize - old_size); + ZSTR_VAL(ms->data)[ZSTR_LEN(ms->data)] = '\0'; } return PHP_STREAM_OPTION_RETURN_OK; }