clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-22 10:27:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed 2 memory corruptions in zip extension idenfied by oo_properties.phpt

Browse Source 
test
This commit is contained in:
Ilia Alshanetsky 2009-02-22 17:54:50 +00:00
parent af84168de6
commit 551a2d52e2
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ext/zip/php_zip.c
View File

@ -792,7 +792,7 @@ static int php_zip_property_reader(ze_zip_object *obj, zip_prop_handler *hnd, zv
switch (hnd->type) {
case IS_STRING:
if (retchar) {
ZVAL_STRING(*retval, (char *) retchar, 1);
ZVAL_STRINGL(*retval, (char *) retchar, len, 1);
} else {
ZVAL_EMPTY_STRING(*retval);
}
@ -915,10 +915,11 @@ static int php_zip_has_property(zval *object, zval *member, int type TSRMLS_DC)
if (ret == SUCCESS) {
zval *tmp;
ALLOC_INIT_ZVAL(tmp);
if (type == 2) {
retval = 1;
} else if (php_zip_property_reader(obj, hnd, &tmp, 1 TSRMLS_CC) == SUCCESS) {
} else if (php_zip_property_reader(obj, hnd, &tmp, 0 TSRMLS_CC) == SUCCESS) {
Z_SET_REFCOUNT_P(tmp, 1);
Z_UNSET_ISREF_P(tmp);
if (type == 1) {
@ -926,8 +927,9 @@ static int php_zip_has_property(zval *object, zval *member, int type TSRMLS_DC)
} else if (type == 0) {
retval = (Z_TYPE_P(tmp) != IS_NULL);
}
zval_ptr_dtor(&tmp);
}
zval_ptr_dtor(&tmp);
} else {
std_hnd = zend_get_std_object_handlers();
retval = std_hnd->has_property(object, member, type TSRMLS_CC);