archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 14:08:47 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.4'

Browse source 
* PHP-8.4:
  Fix out of bound writes to SafeArray data
This commit is contained in:
Christoph M. Becker 2024-10-09 21:16:52 +02:00
commit 8ca1313e38
No known key found for this signature in database
GPG key ID: D66C9593118BCCB6
2 changed files with 34 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
ext/com_dotnet/com_variant.c
View file

@ -26,8 +26,7 @@
/* create an automation SafeArray from a PHP array. /* create an automation SafeArray from a PHP array.
* Only creates a single-dimensional array of variants. * Only creates a single-dimensional array of variants.
* The keys of the PHP hash MUST be numeric. If the array * The keys of the PHP hash MUST be numeric. */
* is sparse, then the gaps will be filled with NULL variants */
static void safe_array_from_zval(VARIANT *v, zval *z, int codepage) static void safe_array_from_zval(VARIANT *v, zval *z, int codepage)
{ {
SAFEARRAY *sa = NULL; SAFEARRAY *sa = NULL;
@ -71,7 +70,9 @@ static void safe_array_from_zval(VARIANT *v, zval *z, int codepage)
break; break;
} }
zend_hash_get_current_key_ex(Z_ARRVAL_P(z), &strindex, &intindex, &pos); zend_hash_get_current_key_ex(Z_ARRVAL_P(z), &strindex, &intindex, &pos);
php_com_variant_from_zval(&va[intindex], item, codepage); if (intindex < bound.cElements) {
php_com_variant_from_zval(&va[intindex], item, codepage);
}
} }
/* Unlock it and stuff it into our variant */ /* Unlock it and stuff it into our variant */

30
ext/com_dotnet/tests/variant_variation.phpt Normal file
View file

@ -0,0 +1,30 @@
--TEST--
Testing variant arrays
--EXTENSIONS--
com_dotnet
--FILE--
<?php
$arrays = [
"order" => [2 => 1, 1 => 2, 0 => 3],
"off" => [2 => 1, 1 => 2, 3],
"negative" => [-1 => 42],
];
foreach ($arrays as $desc => $array) {
echo "-- $desc --\n";
$v = new variant($array);
foreach ($v as $val) {
var_dump($val);
}
}
?>
--EXPECTF--
-- order --
int(3)
int(2)
int(1)
-- off --
NULL
int(2)
int(1)
-- negative --
%ANULL