1 CVE-2014-9705

     2 Community BUG:

     3 https://bugs.php.net/bug.php?id=68552

     4 Community CODE:

     5 http://svn.php.net/viewvc/pecl/enchant/trunk/enchant.c?r1=317600&r2=335803

     6 Below is the community patch.

     7 

     8 

     9 --- a/ext/enchant/enchant.c	2011/10/01 13:13:13	317600

    10 +++ b/ext/enchant/enchant.c	2015/01/26 11:49:40	335803

    11 @@ -549,13 +549,12 @@

    12  

    13  	d = enchant_broker_request_dict(pbroker->pbroker, (const char *)tag);

    14  	if (d) {

    15 +		pos = pbroker->dictcnt++;

    16  		if (pbroker->dictcnt) {

    17  			pbroker->dict = (enchant_dict **)erealloc(pbroker->dict, sizeof(enchant_dict *) * pbroker->dictcnt);

    18 -			pos = pbroker->dictcnt++;

    19  		} else {

    20  			pbroker->dict = (enchant_dict **)emalloc(sizeof(enchant_dict *));

    21  			pos = 0;

    22 -			pbroker->dictcnt++;

    23  		}

    24  

    25  		dict = pbroker->dict[pos] = (enchant_dict *)emalloc(sizeof(enchant_dict));

    26 @@ -606,14 +605,14 @@

    27  

    28  	d = enchant_broker_request_pwl_dict(pbroker->pbroker, (const char *)pwl);

    29  	if (d) {

    30 +		pos = pbroker->dictcnt++;

    31  		if (pbroker->dictcnt) {

    32 -			pos = pbroker->dictcnt++;

    33  			pbroker->dict = (enchant_dict **)erealloc(pbroker->dict, sizeof(enchant_dict *) * pbroker->dictcnt);

    34  		} else {

    35  			pbroker->dict = (enchant_dict **)emalloc(sizeof(enchant_dict *));

    36  			pos = 0;

    37 -			pbroker->dictcnt++;

    38  		}

    39 +

    40  		dict = pbroker->dict[pos] = (enchant_dict *)emalloc(sizeof(enchant_dict));

    41  		dict->id = pos;

    42  		dict->pbroker = pbroker;