clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-22 18:37:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.2' into PHP-7.3

Browse Source 
* PHP-7.2:
  Fixed bug #77395 (segfault about array_multisort)
This commit is contained in:
Xinchen Hui 2019-01-02 12:10:04 +08:00
commit e527626d9f
2 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ext/standard/array.c
View File

@ -5572,7 +5572,7 @@ PHPAPI int php_multisort_compare(const void *a, const void *b) /* {{{ */
/* }}} */ /* }}} */
#define MULTISORT_ABORT \ #define MULTISORT_ABORT \
efree(ARRAYG(multisort_func)); \ efree(func); \
efree(arrays); \ efree(arrays); \
RETURN_FALSE; RETURN_FALSE;
@ -5604,6 +5604,7 @@ PHP_FUNCTION(array_multisort)
int sort_order = PHP_SORT_ASC; int sort_order = PHP_SORT_ASC;
int sort_type = PHP_SORT_REGULAR; int sort_type = PHP_SORT_REGULAR;
int i, k, n; int i, k, n;
compare_func_t *func;
ZEND_PARSE_PARAMETERS_START(1, -1) ZEND_PARSE_PARAMETERS_START(1, -1)
Z_PARAM_VARIADIC('+', args, argc) Z_PARAM_VARIADIC('+', args, argc)
@ -5614,7 +5615,7 @@ PHP_FUNCTION(array_multisort)
for (i = 0; i < MULTISORT_LAST; i++) { for (i = 0; i < MULTISORT_LAST; i++) {
parse_state[i] = 0; parse_state[i] = 0;
} }
ARRAYG(multisort_func) = (compare_func_t*)ecalloc(argc, sizeof(compare_func_t)); func = ARRAYG(multisort_func) = (compare_func_t*)ecalloc(argc, sizeof(compare_func_t));
/* Here we go through the input arguments and parse them. Each one can /* Here we go through the input arguments and parse them. Each one can
* be either an array or a sort flag which follows an array. If not * be either an array or a sort flag which follows an array. If not
@ -5698,7 +5699,7 @@ PHP_FUNCTION(array_multisort)
/* If all arrays are empty we don't need to do anything. */ /* If all arrays are empty we don't need to do anything. */
if (array_size < 1) { if (array_size < 1) {
efree(ARRAYG(multisort_func)); efree(func);
efree(arrays); efree(arrays);
RETURN_TRUE; RETURN_TRUE;
} }
@ -5757,7 +5758,7 @@ PHP_FUNCTION(array_multisort)
efree(indirect[i]); efree(indirect[i]);
} }
efree(indirect); efree(indirect);
efree(ARRAYG(multisort_func)); efree(func);
efree(arrays); efree(arrays);
RETURN_TRUE; RETURN_TRUE;
} }

16
ext/standard/tests/array/bug77395.phpt Normal file
View File

@ -0,0 +1,16 @@
--TEST--
Bug #77395 (segfault about array_multisort)
--FILE--
<?php
function error_handle($level, $message, $file = '', $line = 0){
$a = [1,2,3];
$b = [3,2,1];
echo $message;
array_multisort($a, SORT_ASC, $b); // if comment this line, no segfault happen
}
set_error_handler('error_handle');
$data = [['aa'=> 'bb',], ['aa'=> 'bb',],];
array_multisort(array_column($data, 'bb'),SORT_DESC, $data); // PHP Warning error
?>
--EXPECT--
array_multisort(): Array sizes are inconsistent