Merge branch 'PHP-7.2' into PHP-7.3

* PHP-7.2:
  Fixed bug #77589 (Core dump using parse_ini_string with numeric sections)

Conflicts:
	Zend/zend_ini_scanner.c
This commit is contained in:
Xinchen Hui 2019-02-11 15:28:44 +08:00
commit 4f044f680c
5 changed files with 2876 additions and 2783 deletions

2
NEWS
View File

@ -3,6 +3,8 @@ PHP NEWS
?? ??? ????, PHP 7.3.3
- Core:
. Fixed bug #77589 (Core dump using parse_ini_string with numeric sections).
(Laruence)
. Fixed bug #77329 (Buffer Overflow via overly long Error Messages).
(Dmitry)
. Fixed bug #77494 (Disabling class causes segfault on member access).

40
Zend/tests/bug77589.phpt Normal file
View File

@ -0,0 +1,40 @@
--TEST--
BUG #77589 (Core dump using parse_ini_string with numeric sections)
--FILE--
<?php
var_dump(
parse_ini_string(<<<INI
[0]
a = 1
b = on
c = true
["true"]
a = 100
b = null
c = yes
INI
, TRUE, INI_SCANNER_TYPED));
?>
--EXPECT--
array(2) {
[0]=>
array(3) {
["a"]=>
int(1)
["b"]=>
bool(true)
["c"]=>
bool(true)
}
["true"]=>
array(3) {
["a"]=>
int(100)
["b"]=>
NULL
["c"]=>
bool(true)
}
}

File diff suppressed because it is too large Load Diff

View File

@ -140,13 +140,14 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
ZVAL_NEW_STR(retval, zend_string_init(str, len, ZEND_SYSTEM_INI))
#define RETURN_TOKEN(type, str, len) { \
if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED) { \
zend_ini_copy_typed_value(ini_lval, type, str, len); \
} else { \
zend_ini_copy_value(ini_lval, str, len); \
} \
return type; \
#define RETURN_TOKEN(type, str, len) { \
if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED && \
(YYSTATE == STATE(ST_VALUE) || YYSTATE == STATE(ST_RAW))) {\
zend_ini_copy_typed_value(ini_lval, type, str, len); \
} else { \
zend_ini_copy_value(ini_lval, str, len); \
} \
return type; \
}
static inline int convert_to_number(zval *retval, const char *str, const int str_len)

View File

@ -1,4 +1,4 @@
/* Generated by re2c 1.0.3 */
/* Generated by re2c 0.16 */
#line 3 "Zend/zend_ini_scanner_defs.h"
enum YYCONDTYPE {