clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-21 18:07:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #63173: Crash when invoking invalid array callback

Browse Source 
The code did not check whether the zend_hash_index_find calls succeded,
so PHP crashed when an array callback was called that contains two elements
which don't have the indices 0 and 1.
This commit is contained in:
Nikita Popov 2012-09-27 18:40:00 +02:00
parent 8cdd6bc1e7
commit 592b232e83
3 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Zend/tests/bug63173.phpt Normal file
View File

@ -0,0 +1,12 @@
--TEST--
Bug #63173: Crash when invoking invalid array callback
--FILE--
<?php
// the important part here are the indexes 1 and 2
$callback = [1 => 0, 2 => 0];
$callback();
?>
--EXPECTF--
Fatal error: Array callback has to contain indices 0 and 1 in %s on line %d

4
Zend/zend_vm_def.h
View File

@ -2412,6 +2412,10 @@ ZEND_VM_HANDLER(59, ZEND_INIT_FCALL_BY_NAME, ANY, CONST|TMP|VAR|CV)
zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
if (!obj || !method) {
zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
}
if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
}

16
Zend/zend_vm_execute.h
View File

@ -1256,6 +1256,10 @@ static int ZEND_FASTCALL ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE
zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
if (!obj || !method) {
zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
}
if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
}
@ -1558,6 +1562,10 @@ static int ZEND_FASTCALL ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER(ZEND_OPCODE_H
zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
if (!obj || !method) {
zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
}
if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
}
@ -1722,6 +1730,10 @@ static int ZEND_FASTCALL ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER(ZEND_OPCODE_H
zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
if (!obj || !method) {
zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
}
if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
}
@ -1919,6 +1931,10 @@ static int ZEND_FASTCALL ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER(ZEND_OPCODE_HA
zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
if (!obj || !method) {
zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
}
if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
}