colder Sun Oct 5 14:49:26 2008 UTC Added files: (Branch: PHP_5_2) /php-src/ext/spl/tests array_026.phpt
Modified files: /php-src NEWS /php-src/ext/spl spl_array.c Log: Fix #46222 (Allow indirect modifications of Arrays inside ArrayObject + fix EG(uninitialized_zval_ptr) overwrite) http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1241&r2=1.2027.2.547.2.1242&diff_format=u Index: php-src/NEWS diff -u php-src/NEWS:1.2027.2.547.2.1241 php-src/NEWS:1.2027.2.547.2.1242 --- php-src/NEWS:1.2027.2.547.2.1241 Sun Oct 5 01:40:38 2008 +++ php-src/NEWS Sun Oct 5 14:49:25 2008 @@ -141,6 +141,8 @@ - Fixed bug #42318 (problem with nm on AIX, not finding object files). (Dmitry) - Fixed bug #41348 (OCI8: allow compilation with Oracle 8.1). (Chris Jones) - Fixed bug #14032 (Mail() always returns false but mail is sent). (Mikko) +- Fixed bug #46222 (ArrayObject EG(uninitialized_var_ptr) overwrite). + (Etienne) 01 May 2008, PHP 5.2.6 - Fixed two possible crashes inside posix extension (Tony) http://cvs.php.net/viewvc.cgi/php-src/ext/spl/spl_array.c?r1=1.71.2.17.2.16&r2=1.71.2.17.2.17&diff_format=u Index: php-src/ext/spl/spl_array.c diff -u php-src/ext/spl/spl_array.c:1.71.2.17.2.16 php-src/ext/spl/spl_array.c:1.71.2.17.2.17 --- php-src/ext/spl/spl_array.c:1.71.2.17.2.16 Mon Jul 7 00:02:22 2008 +++ php-src/ext/spl/spl_array.c Sun Oct 5 14:49:25 2008 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: spl_array.c,v 1.71.2.17.2.16 2008/07/07 00:02:22 colder Exp $ */ +/* $Id: spl_array.c,v 1.71.2.17.2.17 2008/10/05 14:49:25 colder Exp $ */ #ifdef HAVE_CONFIG_H # include "config.h" @@ -255,6 +255,7 @@ spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC); zval **retval; long index; + HashTable *ht = spl_array_get_hash_table(intern, 0 TSRMLS_CC); /* We cannot get the pointer pointer so we don't allow it here for now if (check_inherited && intern->fptr_offset_get) { @@ -267,9 +268,17 @@ switch(Z_TYPE_P(offset)) { case IS_STRING: - if (zend_symtable_find(spl_array_get_hash_table(intern, 0 TSRMLS_CC), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, (void **) &retval) == FAILURE) { - zend_error(E_NOTICE, "Undefined index: %s", Z_STRVAL_P(offset)); - return &EG(uninitialized_zval_ptr); + if (zend_symtable_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, (void **) &retval) == FAILURE) { + if (type == BP_VAR_W || type == BP_VAR_RW) { + zval *value; + ALLOC_INIT_ZVAL(value); + zend_symtable_update(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, (void**)&value, sizeof(void*), NULL); + zend_symtable_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, (void **) &retval); + return retval; + } else { + zend_error(E_NOTICE, "Undefined index: %s", Z_STRVAL_P(offset)); + return &EG(uninitialized_zval_ptr); + } } else { return retval; } @@ -282,9 +291,17 @@ } else { index = Z_LVAL_P(offset); } - if (zend_hash_index_find(spl_array_get_hash_table(intern, 0 TSRMLS_CC), index, (void **) &retval) == FAILURE) { - zend_error(E_NOTICE, "Undefined offset: %ld", Z_LVAL_P(offset)); - return &EG(uninitialized_zval_ptr); + if (zend_hash_index_find(ht, index, (void **) &retval) == FAILURE) { + if (type == BP_VAR_W || type == BP_VAR_RW) { + zval *value; + ALLOC_INIT_ZVAL(value); + zend_hash_index_update(ht, index, (void**)&value, sizeof(void*), NULL); + zend_hash_index_find(ht, index, (void **) &retval); + return retval; + } else { + zend_error(E_NOTICE, "Undefined offset: %ld", Z_LVAL_P(offset)); + return &EG(uninitialized_zval_ptr); + } } else { return retval; } http://cvs.php.net/viewvc.cgi/php-src/ext/spl/tests/array_026.phpt?view=markup&rev=1.1 Index: php-src/ext/spl/tests/array_026.phpt +++ php-src/ext/spl/tests/array_026.phpt --TEST-- SPL: ArrayObject indirect offsetGet overwriting EG(uninitialized_zvar_ptr) --FILE-- <?php $test = new ArrayObject(); $test['d1']['d2'] = 'hello'; $test['d1']['d3'] = 'world'; var_dump($test, $test3['mmmmm']); ?> --EXPECTF-- Notice: Undefined variable: test3 in %s%earray_026.php on line 5 object(ArrayObject)#%d (1) { [u"storage":u"ArrayObject":private]=> array(1) { [u"d1"]=> array(2) { [u"d2"]=> unicode(5) "hello" [u"d3"]=> unicode(5) "world" } } } NULL -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php