archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.3' into PHP-8.4

Browse source 
* PHP-8.3:
  Fix out of bound writes to SafeArray data
This commit is contained in:
Christoph M. Becker 2024-10-09 21:16:14 +02:00
commit 42a2b046fe
No known key found for this signature in database
GPG key ID: D66C9593118BCCB6
3 changed files with 37 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
NEWS
View file

@ -2,6 +2,9 @@ PHP NEWS
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.4.0RC3 ?? ??? ????, PHP 8.4.0RC3
- COM:
. Fixed out of bound writes to SafeArray data. (cmb)
- Curl: - Curl:
. Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if . Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if
curl_multi_add_handle fails). (timwolla) curl_multi_add_handle fails). (timwolla)

5
ext/com_dotnet/com_variant.c
View file

@ -26,8 +26,7 @@
/* create an automation SafeArray from a PHP array. /* create an automation SafeArray from a PHP array.
* Only creates a single-dimensional array of variants. * Only creates a single-dimensional array of variants.
* The keys of the PHP hash MUST be numeric. If the array * The keys of the PHP hash MUST be numeric. */
* is sparse, then the gaps will be filled with NULL variants */
static void safe_array_from_zval(VARIANT *v, zval *z, int codepage) static void safe_array_from_zval(VARIANT *v, zval *z, int codepage)
{ {
SAFEARRAY *sa = NULL; SAFEARRAY *sa = NULL;
@ -71,8 +70,10 @@ static void safe_array_from_zval(VARIANT *v, zval *z, int codepage)
break; break;
} }
zend_hash_get_current_key_ex(Z_ARRVAL_P(z), &strindex, &intindex, &pos); zend_hash_get_current_key_ex(Z_ARRVAL_P(z), &strindex, &intindex, &pos);
if (intindex < bound.cElements) {
php_com_variant_from_zval(&va[intindex], item, codepage); php_com_variant_from_zval(&va[intindex], item, codepage);
} }
}
/* Unlock it and stuff it into our variant */ /* Unlock it and stuff it into our variant */
SafeArrayUnaccessData(sa); SafeArrayUnaccessData(sa);

30
ext/com_dotnet/tests/variant_variation.phpt Normal file
View file

@ -0,0 +1,30 @@
--TEST--
Testing variant arrays
--EXTENSIONS--
com_dotnet
--FILE--
<?php
$arrays = [
"order" => [2 => 1, 1 => 2, 0 => 3],
"off" => [2 => 1, 1 => 2, 3],
"negative" => [-1 => 42],
];
foreach ($arrays as $desc => $array) {
echo "-- $desc --\n";
$v = new variant($array);
foreach ($v as $val) {
var_dump($val);
}
}
?>
--EXPECTF--
-- order --
int(3)
int(2)
int(1)
-- off --
NULL
int(2)
int(1)
-- negative --
%ANULL