From:             dan dot colascione at gmail dot com
Operating system: Linux
PHP version:      5.0.4
PHP Bug Type:     Scripting Engine problem
Bug description:  Dangerous INIT_OVERLOADED_CLASS_ENTRY design flaw

Description:
------------
The INIT_OVERLOADED_CLASS_ENTRY macro assumes that it's being passed a
static string array for its class_name parameter. It obtains the length of
the string with sizeof(), when it should be using strlen. This leads to
class names being silently truncated when classes are initialized with a
string variable instead of a static string array.

Reproduce code:
---------------
char* a = get_some_string();
zend_class_entry ce;
INIT_OVERLOADED_CLASS_ENTRY(ce, a, ...);

Expected result:
----------------
The name of the class in ce should be the return value of
get_some_string()

Actual result:
--------------
The name of the class is truncated to sizeof(char*)-1 characters.

-- 
Edit bug report at http://bugs.php.net/?id=33938&edit=1
-- 
Try a CVS snapshot (php4):   http://bugs.php.net/fix.php?id=33938&r=trysnapshot4
Try a CVS snapshot (php5.0): 
http://bugs.php.net/fix.php?id=33938&r=trysnapshot50
Try a CVS snapshot (php5.1): 
http://bugs.php.net/fix.php?id=33938&r=trysnapshot51
Fixed in CVS:                http://bugs.php.net/fix.php?id=33938&r=fixedcvs
Fixed in release:            http://bugs.php.net/fix.php?id=33938&r=alreadyfixed
Need backtrace:              http://bugs.php.net/fix.php?id=33938&r=needtrace
Need Reproduce Script:       http://bugs.php.net/fix.php?id=33938&r=needscript
Try newer version:           http://bugs.php.net/fix.php?id=33938&r=oldversion
Not developer issue:         http://bugs.php.net/fix.php?id=33938&r=support
Expected behavior:           http://bugs.php.net/fix.php?id=33938&r=notwrong
Not enough info:             
http://bugs.php.net/fix.php?id=33938&r=notenoughinfo
Submitted twice:             
http://bugs.php.net/fix.php?id=33938&r=submittedtwice
register_globals:            http://bugs.php.net/fix.php?id=33938&r=globals
PHP 3 support discontinued:  http://bugs.php.net/fix.php?id=33938&r=php3
Daylight Savings:            http://bugs.php.net/fix.php?id=33938&r=dst
IIS Stability:               http://bugs.php.net/fix.php?id=33938&r=isapi
Install GNU Sed:             http://bugs.php.net/fix.php?id=33938&r=gnused
Floating point limitations:  http://bugs.php.net/fix.php?id=33938&r=float
No Zend Extensions:          http://bugs.php.net/fix.php?id=33938&r=nozend
MySQL Configuration Error:   http://bugs.php.net/fix.php?id=33938&r=mysqlcfg

Reply via email to