invalid read of 2 bytes in hashtable

git-svn-id: svn://svn.lighttpd.net/xcache/trunk@1495 c26eb9a1-5813-0410-bd6c-c2e55f420ca7

mod_disassembler/xc_disassembler.c

@@ -48,7 +48,7 @@ static void xc_dasm(zval *output, zend_op_array *op_array TSRMLS_DC) /* {{{ */
 			} while (keysize > bufsize);
 			buf = erealloc(buf, bufsize);
 		}
-		memcpy(buf, BUCKET_KEY_S(b), keysize);
+		memcpy(buf, BUCKET_KEY_S(b), keysize - 2);
 		buf[keysize - 2] = buf[keysize - 1] = ""[0];
 		keyLength = b->nKeyLength;
 #ifdef IS_UNICODE
@@ -84,7 +84,7 @@ static void xc_dasm(zval *output, zend_op_array *op_array TSRMLS_DC) /* {{{ */
 			} while (keysize > bufsize);
 			buf = erealloc(buf, bufsize);
 		}
-		memcpy(buf, BUCKET_KEY_S(b), keysize);
+		memcpy(buf, BUCKET_KEY_S(b), keysize - 2);
 		buf[keysize - 2] = buf[keysize - 1] = ""[0];
 		keyLength = b->nKeyLength;
 #ifdef IS_UNICODE

processor/hashtable.m4

@@ -24,7 +24,7 @@ define(`DEF_HASH_TABLE_FUNC', `DEF_STRUCT_P_FUNC(`HashTable', `$1', `
 				} while (keysize > bufsize);
 				buf = erealloc(buf, bufsize);
 			}
-			memcpy(buf, BUCKET_KEY_S(srcBucket), keysize);
+			memcpy(buf, BUCKET_KEY_S(srcBucket), keysize - 2);
 			buf[keysize - 2] = buf[keysize - 1] = ""[0];
 			keysize = srcBucket->nKeyLength;
 #ifdef IS_UNICODE