dmitry Wed, 12 May 2010 11:32:25 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=299281
Log: Fixed a possible memory corruption in parse_str(). Reported by Stefan Esser Changed paths: U php/php-src/branches/PHP_5_3/NEWS U php/php-src/branches/PHP_5_3/ext/standard/string.c U php/php-src/trunk/ext/standard/string.c Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2010-05-12 11:10:06 UTC (rev 299280) +++ php/php-src/branches/PHP_5_3/NEWS 2010-05-12 11:32:25 UTC (rev 299281) @@ -28,6 +28,8 @@ - Fixed a possible memory corruption because of unexpected call-time pass by refernce and following memory clobbering through callbacks. Reported by Stefan Esser (Dmitry) +- Fixed a possible memory corruption in parse_str(). Reported by Stefan Esser + (Dmitry) - Fixed a possible memory corruption in pack(). Reported by Stefan Esser (Dmitry) - Fixed a possible memory corruption in substr_replace(). Reported by Stefan Modified: php/php-src/branches/PHP_5_3/ext/standard/string.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/standard/string.c 2010-05-12 11:10:06 UTC (rev 299280) +++ php/php-src/branches/PHP_5_3/ext/standard/string.c 2010-05-12 11:32:25 UTC (rev 299281) @@ -4146,11 +4146,14 @@ Z_ARRVAL(tmp) = EG(active_symbol_table); sapi_module.treat_data(PARSE_STRING, res, &tmp TSRMLS_CC); } else { + zval ret; + + array_init(&ret); + sapi_module.treat_data(PARSE_STRING, res, &ret TSRMLS_CC); /* Clear out the array that was passed in. */ zval_dtor(arrayArg); - array_init(arrayArg); - - sapi_module.treat_data(PARSE_STRING, res, arrayArg TSRMLS_CC); + arrayArg->type = ret.type; + arrayArg->value = ret.value; } } /* }}} */ Modified: php/php-src/trunk/ext/standard/string.c =================================================================== --- php/php-src/trunk/ext/standard/string.c 2010-05-12 11:10:06 UTC (rev 299280) +++ php/php-src/trunk/ext/standard/string.c 2010-05-12 11:32:25 UTC (rev 299281) @@ -4146,11 +4146,13 @@ Z_ARRVAL(tmp) = EG(active_symbol_table); sapi_module.treat_data(PARSE_STRING, res, &tmp TSRMLS_CC); } else { + zval ret; + + array_init(&ret); + sapi_module.treat_data(PARSE_STRING, res, &ret TSRMLS_CC); /* Clear out the array that was passed in. */ zval_dtor(arrayArg); - array_init(arrayArg); - - sapi_module.treat_data(PARSE_STRING, res, arrayArg TSRMLS_CC); + ZVAL_COPY_VALUE(arrayArg, &ret); } } /* }}} */
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php