summaryrefslogtreecommitdiff
path: root/ext/bz2
diff options
context:
space:
mode:
authorStanislav Malyshev <stas@php.net>2016-06-18 22:10:22 -0700
committerStanislav Malyshev <stas@php.net>2016-06-18 22:10:22 -0700
commit42b2d7fec54ec7ea0bc352c502674d6192c8a6fa (patch)
tree1a15c4be3f72da397defab1a690404a732a39b1d /ext/bz2
parentc4c1993af63fe4c0d19d44ebbd38996471c141af (diff)
downloadphp-git-42b2d7fec54ec7ea0bc352c502674d6192c8a6fa.tar.gz
Fix bug #72447: Type Confusion in php_bz2_filter_create()
Diffstat (limited to 'ext/bz2')
-rw-r--r--ext/bz2/bz2_filter.c2
-rw-r--r--ext/bz2/tests/bug72447.phpt15
2 files changed, 16 insertions, 1 deletions
diff --git a/ext/bz2/bz2_filter.c b/ext/bz2/bz2_filter.c
index 705ef9d114..38115a523c 100644
--- a/ext/bz2/bz2_filter.c
+++ b/ext/bz2/bz2_filter.c
@@ -396,7 +396,7 @@ static php_stream_filter *php_bz2_filter_create(const char *filtername, zval *fi
zval_copy_ctor(&tmp);
convert_to_long(&tmp);
if (Z_LVAL(tmp) < 1 || Z_LVAL(tmp) > 9) {
- php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter given for number of blocks to allocate. (%ld)", Z_LVAL_PP(tmpzval));
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter given for number of blocks to allocate. (%ld)", Z_LVAL(tmp));
} else {
blockSize100k = Z_LVAL(tmp);
}
diff --git a/ext/bz2/tests/bug72447.phpt b/ext/bz2/tests/bug72447.phpt
new file mode 100644
index 0000000000..0df4cb177b
--- /dev/null
+++ b/ext/bz2/tests/bug72447.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #72447: Type Confusion in php_bz2_filter_create()
+--SKIPIF--
+<?php if (!extension_loaded("bz2")) print "skip"; ?>
+--FILE--
+<?php
+$input = "AAAAAAAA";
+$param = array('blocks' => $input);
+
+$fp = fopen('testfile', 'w');
+stream_filter_append($fp, 'bzip2.compress', STREAM_FILTER_WRITE, $param);
+fclose($fp);
+?>
+--EXPECTF--
+Warning: stream_filter_append(): Invalid parameter given for number of blocks to allocate. (0) in %s/bug72447.php on line %d