archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-7.2' into PHP-7.3

Browse source
This commit is contained in:
Nikita Popov 2019-04-08 11:12:42 +02:00
commit 0a25b41f6d
3 changed files with 39 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -38,6 +38,8 @@ PHP NEWS
- Standard: - Standard:
. Fixed bug #77793 (Segmentation fault in extract() when overwriting . Fixed bug #77793 (Segmentation fault in extract() when overwriting
reference with itself). (Nikita) reference with itself). (Nikita)
. Fixed bug #77844 (Crash due to null pointer in parse_ini_string with
INI_SCANNER_TYPED). (Nikita)
04 Apr 2019, PHP 7.3.4 04 Apr 2019, PHP 7.3.4

34
Zend/zend_ini_parser.y
View file

@ -46,6 +46,22 @@ int ini_parse(void);
#define ZEND_SYSTEM_INI CG(ini_parser_unbuffered_errors) #define ZEND_SYSTEM_INI CG(ini_parser_unbuffered_errors)
static int get_int_val(zval *op) {
switch (Z_TYPE_P(op)) {
case IS_LONG:
return Z_LVAL_P(op);
case IS_DOUBLE:
return (int)Z_DVAL_P(op);
case IS_STRING:
{
int val = atoi(Z_STRVAL_P(op));
zend_string_free(Z_STR_P(op));
return val;
}
EMPTY_SWITCH_DEFAULT_CASE()
}
}
/* {{{ zend_ini_do_op() /* {{{ zend_ini_do_op()
*/ */
static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2) static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
@ -55,22 +71,8 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
int str_len; int str_len;
char str_result[MAX_LENGTH_OF_LONG+1]; char str_result[MAX_LENGTH_OF_LONG+1];
if (IS_LONG == Z_TYPE_P(op1)) { i_op1 = get_int_val(op1);
i_op1 = Z_LVAL_P(op1); i_op2 = op2 ? get_int_val(op2) : 0;
} else {
i_op1 = atoi(Z_STRVAL_P(op1));
zend_string_free(Z_STR_P(op1));
}
if (op2) {
if (IS_LONG == Z_TYPE_P(op2)) {
i_op2 = Z_LVAL_P(op2);
} else {
i_op2 = atoi(Z_STRVAL_P(op2));
zend_string_free(Z_STR_P(op2));
}
} else {
i_op2 = 0;
}
switch (type) { switch (type) {
case '|': case '|':

19
ext/standard/tests/general_functions/bug77844.phpt Normal file
View file

@ -0,0 +1,19 @@
--TEST--
Bug #77844: Crash due to null pointer in parse_ini_string with INI_SCANNER_TYPED
--FILE--
<?php
$ini = <<<INI
val1=3.7&2
val2=2&3.7
INI;
var_dump(parse_ini_string($ini, true, INI_SCANNER_TYPED));
?>
--EXPECT--
array(2) {
["val1"]=>
string(1) "2"
["val2"]=>
string(1) "2"
}