From 1a64dc2c08bedf31734e4445b1f45028db813f90 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@gmail.com>
Date: Wed, 21 Aug 2013 18:55:22 +0800
Subject: [PATCH] Fixed bug that alter_response is not binary safe

---
 package2.xml   |   7 +++++++
 tests/069.phpt | Bin 0 -> 768 bytes
 yaf_response.c |  51 +++++++++++++++++++++++++++++++++----------------
 3 files changed, 42 insertions(+), 16 deletions(-)
 create mode 100644 tests/069.phpt

diff --git a/package2.xml b/package2.xml
index 3d370eda..90ecb541 100644
--- a/package2.xml
+++ b/package2.xml
@@ -156,6 +156,13 @@
     <file name="060.phpt" role="test" />
     <file name="061.phpt" role="test" />
     <file name="062.phpt" role="test" />
+    <file name="063.phpt" role="test" />
+    <file name="064.phpt" role="test" />
+    <file name="065.phpt" role="test" />
+    <file name="066.phpt" role="test" />
+    <file name="067.phpt" role="test" />
+    <file name="068.phpt" role="test" />
+    <file name="069.phpt" role="test" />
     <file name="build.inc" role="test" />
     <file name="bug61493.phpt" role="test" />
     <file name="bug63381.phpt" role="test" />
diff --git a/tests/069.phpt b/tests/069.phpt
new file mode 100644
index 0000000000000000000000000000000000000000..cecc1b6579a60a2a4e7ae322c85c800b22d6e931
GIT binary patch
literal 768
zcma)4%Wm5+5bV|biY<|Y1Xy<NenBu~M5y5ih!5#WpeZUM%8)D{wT&YGUXo7jAn2hw
z5W?=v?#|8@#lCvl7X{kz6YJpMU%(B-0TGUw)-bD;v<$cfsT>@*B<2j3^b8fn)3>^*
zH-S4}=|KbUA^XZsj!DavY=t5n>oR;MJ<fB`hD!(7{@@zVV6_bVdRGT>$WOdwt<|C>
z-l@o2+^4WmM@m9U6F0nvB2tpqFc+aL#EN25Z>#GJ$grQD8wU8`x#%WbQanS}5#zkh
z@)<&RRLP#dzygRd<eZ@qCRz(li3?L>SS+uJ5$-}M>XbRBc-b`DdR^}8$6ec$`-d?a
z<zp0!_FRN1y=z19px@c-GZrR*r!i}k5X{(VEjxCaguUT0%;)pwp}DLP0RR=mT1bfX
zl>%wCorUkDZ*SqYJXmK4b?`e<FQ4{@pa^;|X;cL~HY?MAmVX4kMa~<F-J_2G74nO-
zqn)Ozmp2G;uOdjn10x+=4ua7^0Ub<spU+lHaD)pS_7Ix2)#Emq5mq0ZknEULl{X`@
wcb@|4E`W-q@iO|C4rjfs%H3bj|7kfOJ9yWr<Be23H`RI{&ozzsCC!8W0PM~0{r~^~

literal 0
HcmV?d00001

diff --git a/yaf_response.c b/yaf_response.c
index 8cfe9b11..a9471df9 100644
--- a/yaf_response.c
+++ b/yaf_response.c
@@ -130,6 +130,7 @@ static int yaf_response_set_body(yaf_response_t *response, char *name, int name_
 int yaf_response_alter_body(yaf_response_t *response, char *name, int name_len, char *body, long body_len, int flag TSRMLS_DC) {
 	zval *zbody, **ppzval;
 	char *obody;
+	long obody_len;
 
 	if (!body_len) {
 		return 1;
@@ -144,28 +145,46 @@ int yaf_response_alter_body(yaf_response_t *response, char *name, int name_len,
 
 	if (zend_hash_find(Z_ARRVAL_P(zbody), name, name_len + 1, (void **)&ppzval) == FAILURE) {
 		zval *body;
+		obody = NULL;
 		MAKE_STD_ZVAL(body);
-		ZVAL_EMPTY_STRING(body);
+		ZVAL_NULL(body);
 		zend_hash_update(Z_ARRVAL_P(zbody), name, name_len +1, (void **)&body, sizeof(zval *), (void **)&ppzval);
+	} else {
+		obody = Z_STRVAL_PP(ppzval);
+		obody_len = Z_STRLEN_PP(ppzval);
 	}
 
-	obody = Z_STRVAL_PP(ppzval);
-
-	switch (flag) {
-		case YAF_RESPONSE_PREPEND:
-			Z_STRLEN_PP(ppzval) = spprintf(&Z_STRVAL_PP(ppzval), 0, "%s%s", body, obody);
-			break;
-		case YAF_RESPONSE_APPEND:
-			Z_STRLEN_PP(ppzval) = spprintf(&Z_STRVAL_PP(ppzval), 0, "%s%s", obody, body);
-			break;
-		case YAF_RESPONSE_REPLACE:
-		default:
-			ZVAL_STRINGL(*ppzval, body, body_len, 1);
-			break;
+	if (obody) {
+		char *result;
+		long result_len;
+
+		switch (flag) {
+			case YAF_RESPONSE_PREPEND:
+				result_len = body_len + obody_len;
+				result = emalloc(result_len + 1);
+				memcpy(result, body, body_len);
+				memcpy(result + body_len, obody, obody_len);
+				result[result_len] = '\0';
+				ZVAL_STRINGL(*ppzval, result, result_len, 0);
+				break;
+			case YAF_RESPONSE_APPEND:
+				result_len = body_len + obody_len;
+				result = emalloc(result_len + 1);
+				memcpy(result, obody, obody_len);
+				memcpy(result + obody_len, body, body_len);
+				result[result_len] = '\0';
+				ZVAL_STRINGL(*ppzval, result, result_len, 0);
+				break;
+			case YAF_RESPONSE_REPLACE:
+			default:
+				ZVAL_STRINGL(*ppzval, body, body_len, 1);
+				break;
+		}
+		efree(obody);
+	} else {
+		ZVAL_STRINGL(*ppzval, body, body_len, 1);
 	}
 
-	efree(obody);
-
 	return 1;
 }
 /* }}} */