diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2019-10-19 11:48:40 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2019-10-19 11:49:18 +0200 |
| commit | ce035dc4a0732c090741c85f179f36a4b4b6b92d (patch) | |
| tree | 2915be079287274fa9da9562428f8397f30fa0c1 | |
| parent | c7c7ab53ac28fc64625511e1c2be37036f5f89c1 (diff) | |
| parent | 45a7723267741be4867306d18b15a4a27d67b0f7 (diff) | |
| download | php-git-ce035dc4a0732c090741c85f179f36a4b4b6b92d.tar.gz | |
Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2:
Fix #78694: Appending to a variant array causes segfault
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/com_dotnet/com_handlers.c | 5 | ||||
| -rw-r--r-- | ext/com_dotnet/tests/bug78694.phpt | 19 |
3 files changed, 27 insertions, 0 deletions
@@ -7,6 +7,9 @@ PHP NEWS . Fixed bug #78656 (Parse errors classified as highest log-level). (Erik Lundin) +- COM: + . Fixed bug #78694 (Appending to a variant array causes segfault). (cmb) + - Date: . Fixed bug #70153 (\DateInterval incorrectly unserialized). (Maksim Iakunin) diff --git a/ext/com_dotnet/com_handlers.c b/ext/com_dotnet/com_handlers.c index 66218cfae8..4278818511 100644 --- a/ext/com_dotnet/com_handlers.c +++ b/ext/com_dotnet/com_handlers.c @@ -123,6 +123,11 @@ static void com_write_dimension(zval *object, zval *offset, zval *value) obj = CDNO_FETCH(object); + if (offset == NULL) { + php_com_throw_exception(DISP_E_BADINDEX, "appending to variants is not supported"); + return; + } + if (V_VT(&obj->v) == VT_DISPATCH) { ZVAL_COPY_VALUE(&args[0], offset); ZVAL_COPY_VALUE(&args[1], value); diff --git a/ext/com_dotnet/tests/bug78694.phpt b/ext/com_dotnet/tests/bug78694.phpt new file mode 100644 index 0000000000..adf0c828ca --- /dev/null +++ b/ext/com_dotnet/tests/bug78694.phpt @@ -0,0 +1,19 @@ +--TEST-- +Bug #78694 (Appending to a variant array causes segfault) +--SKIPIF-- +<?php +if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available'); +?> +--FILE-- +<?php +foreach ([new com('WScript.Shell'), new variant([])] as $var) { + try { + $var[] = 42; + } catch (com_exception $ex) { + var_dump($ex->getMessage()); + } +} +?> +--EXPECT-- +string(38) "appending to variants is not supported" +string(38) "appending to variants is not supported" |