tony2001 Tue Oct 4 07:19:56 2005 EDT
Modified files: (Branch: PHP_4_4)
/php-src NEWS
/php-src/ext/xmlrpc xmlrpc-epi-php.c
Log:
MFB5.1: fix #32179 (xmlrpc_encode() segfaults with recursive references)
http://cvs.php.net/diff.php/php-src/NEWS?r1=1.1247.2.920.2.44&r2=1.1247.2.920.2.45&ty=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.1247.2.920.2.44 php-src/NEWS:1.1247.2.920.2.45
--- php-src/NEWS:1.1247.2.920.2.44 Thu Sep 29 12:31:46 2005
+++ php-src/NEWS Tue Oct 4 07:19:55 2005
@@ -43,6 +43,7 @@
- Fixed bug #33156 (cygwin version of setitimer doesn't accept ITIMER_PROF).
(Nuno)
- Fixed bug #32589 (possible crash inside imap_mail_compose() function). (Ilia)
+- Fixed bug #32179 (xmlrpc_encode() segfaults with recursive references).
(Tony)
- Fixed bug #32160 (copying a file into itself leads to data loss). (Ilia)
- Fixed bug #31158 (array_splice on $GLOBALS crashes). (Dmitry)
- Fixed bug #29253 (array_diff with $GLOBALS argument fails). (Dmitry)
http://cvs.php.net/diff.php/php-src/ext/xmlrpc/xmlrpc-epi-php.c?r1=1.24.2.4&r2=1.24.2.4.4.1&ty=u
Index: php-src/ext/xmlrpc/xmlrpc-epi-php.c
diff -u php-src/ext/xmlrpc/xmlrpc-epi-php.c:1.24.2.4
php-src/ext/xmlrpc/xmlrpc-epi-php.c:1.24.2.4.4.1
--- php-src/ext/xmlrpc/xmlrpc-epi-php.c:1.24.2.4 Thu Aug 28 16:01:32 2003
+++ php-src/ext/xmlrpc/xmlrpc-epi-php.c Tue Oct 4 07:19:56 2005
@@ -51,7 +51,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: xmlrpc-epi-php.c,v 1.24.2.4 2003/08/28 20:01:32 iliaa Exp $ */
+/* $Id: xmlrpc-epi-php.c,v 1.24.2.4.4.1 2005/10/04 11:19:56 tony2001 Exp $ */
/**********************************************************************
* BUGS: *
@@ -524,28 +524,41 @@
unsigned long num_index;
zval** pIter;
char* my_key;
+ HashTable *ht = NULL;
+ ht = HASH_OF(val);
+ if (ht && ht->nApplyCount > 1) {
+ php_error_docref(NULL TSRMLS_CC, E_ERROR, "XML-RPC
doesn't support circular references");
+ return NULL;
+ }
+
convert_to_array(val);
-
xReturn = XMLRPC_CreateVector(key,
determine_vector_type(Z_ARRVAL_P(val)));
zend_hash_internal_pointer_reset(Z_ARRVAL_P(val));
- while(1) {
+ while(zend_hash_get_current_data(Z_ARRVAL_P(val),
(void**)&pIter) == SUCCESS) {
int res = my_zend_hash_get_current_key(Z_ARRVAL_P(val),
&my_key, &num_index);
- if(res == HASH_KEY_IS_LONG) {
- if(zend_hash_get_current_data(Z_ARRVAL_P(val),
(void**)&pIter) == SUCCESS) {
- XMLRPC_AddValueToVector(xReturn,
PHP_to_XMLRPC_worker(0, *pIter, depth++));
- }
- }
- else if(res == HASH_KEY_NON_EXISTANT) {
- break;
+
+ switch (res) {
+ case HASH_KEY_NON_EXISTANT:
+ break;
+ case HASH_KEY_IS_STRING:
+ case HASH_KEY_IS_LONG:
+ ht = HASH_OF(*pIter);
+ if (ht) {
+ ht->nApplyCount++;
+ }
+ if (res == HASH_KEY_IS_LONG) {
+ XMLRPC_AddValueToVector(xReturn,
PHP_to_XMLRPC_worker(0, *pIter, depth++));
+ }
+ else {
+ XMLRPC_AddValueToVector(xReturn,
PHP_to_XMLRPC_worker(my_key, *pIter, depth++));
+ }
+ if (ht) {
+ ht->nApplyCount--;
+ }
+ break;
}
- else if(res == HASH_KEY_IS_STRING) {
- if(zend_hash_get_current_data(Z_ARRVAL_P(val),
(void**)&pIter) == SUCCESS) {
- XMLRPC_AddValueToVector(xReturn,
PHP_to_XMLRPC_worker(my_key, *pIter, depth++));
- }
- }
-
zend_hash_move_forward(Z_ARRVAL_P(val));
}
}
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
