clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-21 18:07:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #72162 (use-after-free - error_reporting)

Browse Source
This commit is contained in:
Xinchen Hui 2016-05-05 11:02:21 +08:00
parent 0691e7a8e1
commit 9191862121
3 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@ -3,6 +3,7 @@ PHP NEWS
?? ??? 2016 PHP 7.0.7
- Core:
. Fixed bug #72162 (use-after-free - error_reporting). (Laruence)
. Add compiler option to disable special case function calls. (Joe)
. Fixed bug #72101 (crash on complex code). (Dmitry)
. Fixed bug #72100 (implode() inserts garbage into resulting string when

11
Zend/tests/bug72162.phpt Normal file
View File

@ -0,0 +1,11 @@
--TEST--
Bug #72162 (use-after-free - error_reporting)
--FILE--
<?php
error_reporting(1);
$var11 = new StdClass();
$var16 = error_reporting($var11);
?>
okey
--EXPECT--
okey

5
Zend/zend_builtin_functions.c
View File

@ -704,7 +704,8 @@ ZEND_FUNCTION(error_reporting)
#endif
old_error_reporting = EG(error_reporting);
if(ZEND_NUM_ARGS() != 0) {
if (ZEND_NUM_ARGS() != 0) {
zend_string *new_val = zval_get_string(err);
do {
zend_ini_entry *p = EG(error_reporting_ini_entry);
@ -730,7 +731,7 @@ ZEND_FUNCTION(error_reporting)
zend_string_release(p->value);
}
p->value = zval_get_string(err);
p->value = new_val;
if (Z_TYPE_P(err) == IS_LONG) {
EG(error_reporting) = Z_LVAL_P(err);
} else {