diff options
| author | Xinchen Hui <laruence@gmail.com> | 2016-05-05 11:02:34 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2016-05-05 11:02:34 +0800 |
| commit | badf1edffdee01739c9184bd62965d749cf0cdaf (patch) | |
| tree | da61c72c065e450d0054cd66dca08277e1372c1f | |
| parent | 35e7573a338c28d41c2c0228e58a4dff373f783b (diff) | |
| parent | 9191862121411858036b0d2a06c3a99229c8bd24 (diff) | |
| download | php-git-badf1edffdee01739c9184bd62965d749cf0cdaf.tar.gz | |
Merge branch 'PHP-7.0'
* PHP-7.0:
Fixed bug #72162 (use-after-free - error_reporting)
| -rw-r--r-- | Zend/tests/bug72162.phpt | 11 | ||||
| -rw-r--r-- | Zend/zend_builtin_functions.c | 5 |
2 files changed, 14 insertions, 2 deletions
diff --git a/Zend/tests/bug72162.phpt b/Zend/tests/bug72162.phpt new file mode 100644 index 0000000000..3cd12dea21 --- /dev/null +++ b/Zend/tests/bug72162.phpt @@ -0,0 +1,11 @@ +--TEST-- +Bug #72162 (use-after-free - error_reporting) +--FILE-- +<?php +error_reporting(1); +$var11 = new StdClass(); +$var16 = error_reporting($var11); +?> +okey +--EXPECT-- +okey diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c index e5f77d8960..6e251f6109 100644 --- a/Zend/zend_builtin_functions.c +++ b/Zend/zend_builtin_functions.c @@ -770,7 +770,8 @@ ZEND_FUNCTION(error_reporting) #endif old_error_reporting = EG(error_reporting); - if(ZEND_NUM_ARGS() != 0) { + if (ZEND_NUM_ARGS() != 0) { + zend_string *new_val = zval_get_string(err); do { zend_ini_entry *p = EG(error_reporting_ini_entry); @@ -796,7 +797,7 @@ ZEND_FUNCTION(error_reporting) zend_string_release(p->value); } - p->value = zval_get_string(err); + p->value = new_val; if (Z_TYPE_P(err) == IS_LONG) { EG(error_reporting) = Z_LVAL_P(err); } else { |