Merge pull request #252 from dictcp/fix-null-string-decompress

krakjoe · krakjoe · commit 0986493e8476 · 2016-06-09T15:45:46.000+01:00
fix #250: non-null-terminated zend_string in s_decompress_value
diff --git a/php_memcached.c b/php_memcached.c
@@ -3443,6 +3443,8 @@ zend_string *s_decompress_value (const char *payload, size_t payload_len, uint32
 		decompress_status = (uncompress((Bytef *) buffer->val, &buffer->len, (Bytef *)payload, payload_len) == Z_OK);
 	}
 
+	ZSTR_VAL(buffer)[stored_length] = '\0';
+
 	if (!decompress_status) {
 		php_error_docref(NULL, E_WARNING, "could not decompress value");
 		zend_string_release (buffer);

Original file line number	Diff line number	Diff line change
`@@ -3443,6 +3443,8 @@ zend_string s_decompress_value (const char payload, size_t payload_len, uint32`
`3443`	`3443`	`decompress_status = (uncompress((Bytef ) buffer->val, &buffer->len, (Bytef )payload, payload_len) == Z_OK);`
`3444`	`3444`	`}`
`3445`	`3445`
	`3446`	`+ ZSTR_VAL(buffer)[stored_length] = '\0';`
	`3447`	`+`
`3446`	`3448`	`if (!decompress_status) {`
`3447`	`3449`	`php_error_docref(NULL, E_WARNING, "could not decompress value");`
`3448`	`3450`	`zend_string_release (buffer);`