iliaa Thu Jul 8 13:07:22 2004 EDT Modified files: /php-src/ext/standard array.c Log: Fixed bug #29049 (array sorting via user function/method does not validate it). http://cvs.php.net/diff.php/php-src/ext/standard/array.c?r1=1.261&r2=1.262&ty=u Index: php-src/ext/standard/array.c diff -u php-src/ext/standard/array.c:1.261 php-src/ext/standard/array.c:1.262 --- php-src/ext/standard/array.c:1.261 Tue May 4 11:03:48 2004 +++ php-src/ext/standard/array.c Thu Jul 8 13:07:22 2004 @@ -21,7 +21,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: array.c,v 1.261 2004/05/04 15:03:48 wez Exp $ */ +/* $Id: array.c,v 1.262 2004/07/08 17:07:22 iliaa Exp $ */ #include "php.h" #include "php_ini.h" @@ -569,6 +569,14 @@ } } +/* check is comparison function is valid */ +#define PHP_ARRAY_CMP_FUNC_CHECK(func_name) \ + if (!zend_is_callable(*func_name, 0, NULL)) { \ + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid comparison function."); \ + BG(user_compare_func_name) = old_compare_func; \ + RETURN_FALSE; \ + } \ + /* {{{ proto bool usort(array array_arg, string cmp_function) Sort an array by values using a user-defined comparison function */ PHP_FUNCTION(usort) @@ -590,6 +598,9 @@ BG(user_compare_func_name) = old_compare_func; RETURN_FALSE; } + + PHP_ARRAY_CMP_FUNC_CHECK(BG(user_compare_func_name)) + if (zend_hash_sort(target_hash, zend_qsort, array_user_compare, 1 TSRMLS_CC) == FAILURE) { BG(user_compare_func_name) = old_compare_func; RETURN_FALSE; @@ -619,6 +630,9 @@ BG(user_compare_func_name) = old_compare_func; RETURN_FALSE; } + + PHP_ARRAY_CMP_FUNC_CHECK(BG(user_compare_func_name)) + if (zend_hash_sort(target_hash, zend_qsort, array_user_compare, 0 TSRMLS_CC) == FAILURE) { BG(user_compare_func_name) = old_compare_func; RETURN_FALSE; @@ -694,6 +708,9 @@ BG(user_compare_func_name) = old_compare_func; RETURN_FALSE; } + + PHP_ARRAY_CMP_FUNC_CHECK(BG(user_compare_func_name)) + if (zend_hash_sort(target_hash, zend_qsort, array_user_key_compare, 0 TSRMLS_CC) == FAILURE) { BG(user_compare_func_name) = old_compare_func; RETURN_FALSE;
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php