diff options
| author | Xinchen Hui <laruence@gmail.com> | 2016-05-05 11:12:17 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2016-05-05 11:12:17 +0800 |
| commit | 1a5d58b28fe96e82836c627bc833499707ac4ec5 (patch) | |
| tree | 11052a812d46e51e4dde5d70f63cb99dc837a955 /ext/dba | |
| parent | 9191862121411858036b0d2a06c3a99229c8bd24 (diff) | |
| download | php-git-1a5d58b28fe96e82836c627bc833499707ac4ec5.tar.gz | |
Fixed bug #72157 (use-after-free caused by dba_open)
Diffstat (limited to 'ext/dba')
| -rw-r--r-- | ext/dba/dba.c | 6 | ||||
| -rw-r--r-- | ext/dba/tests/bug72157.phpt | 22 |
2 files changed, 23 insertions, 5 deletions
diff --git a/ext/dba/dba.c b/ext/dba/dba.c index e4776e734e..fd4522b9d6 100644 --- a/ext/dba/dba.c +++ b/ext/dba/dba.c @@ -658,11 +658,7 @@ static void php_dba_open(INTERNAL_FUNCTION_PARAMETERS, int persistent) /* we only take string arguments */ for (i = 0; i < ac; i++) { - if (Z_TYPE(args[i]) != IS_STRING) { - convert_to_string_ex(&args[i]); - } else if (Z_REFCOUNTED(args[i])) { - Z_ADDREF(args[i]); - } + ZVAL_STR(&args[i], zval_get_string(&args[i])); keylen += Z_STRLEN(args[i]); } diff --git a/ext/dba/tests/bug72157.phpt b/ext/dba/tests/bug72157.phpt new file mode 100644 index 0000000000..7b3217012a --- /dev/null +++ b/ext/dba/tests/bug72157.phpt @@ -0,0 +1,22 @@ +--TEST-- +Bug #72157 (use-after-free caused by dba_open) +--SKIPIF-- +<?php + require_once(dirname(__FILE__) .'/skipif.inc'); +?> +--FILE-- +<?php +$var0 = fopen(__FILE__,"r"); +$var5 = dba_open(null,$var0); +$var5 = dba_open(null,$var0); +$var5 = dba_open(null,$var0); +$var5 = dba_open($var0,$var0); +?> +--EXPECTF-- +Warning: dba_open(,Resource id #5): Illegal DBA mode in %sbug72157.php on line %d + +Warning: dba_open(,Resource id #5): Illegal DBA mode in %sbug72157.php on line %d + +Warning: dba_open(,Resource id #5): Illegal DBA mode in %sbug72157.php on line %d + +Warning: dba_open(Resource id #5,Resource id #5): Illegal DBA mode in %sbug72157.php on line %d |