Fixed bug #64821 Custom Exceptions crash when internal properties overridden

If user inherits Exception and overrides the properties to arbitrary data types,
or simply doesn't run parent::__construct(), here we go. Just convert everything
to the appropriate data type, like Exception::__toString() does.

5 files changed, 74 insertions, 1 deletions

diff --git a/NEWS b/NEWS
index 809aad9edc..eae701eba1 100644
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,10 @@ PHP                                                                        NEWS
   . Fixed bug #64770 (stream_select() fails with pipes returned by proc_open()
     on Windows x64). (Anatol)
 
+- Zend Engine:
+  . Fixed bug #64821 (Custom Exception crash when internal properties overridden).
+    (Anatol)
+
 09 May 2013, PHP 5.3.25
 
 - Core:
diff --git a/Zend/tests/bug64821.1.phpt b/Zend/tests/bug64821.1.phpt
new file mode 100644
index 0000000000..5e2093c472
--- /dev/null
+++ b/Zend/tests/bug64821.1.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #64821 Custom Exceptions crash when internal properties overridden (variation 1)
+--FILE--
+<?php
+
+class a extends exception {
+	public function __construct() {
+		$this->message = NULL;
+		$this->string  = NULL;
+		$this->code    = array();
+		$this->line = "hello";
+	}
+}
+
+throw new a;
+
+?>
+--EXPECTF--
+Fatal error: Uncaught exception 'a' in %s:0
+Stack trace:
+#0 {main}
+  thrown in %s on line %d
diff --git a/Zend/tests/bug64821.2.phpt b/Zend/tests/bug64821.2.phpt
new file mode 100644
index 0000000000..91a43f500b
--- /dev/null
+++ b/Zend/tests/bug64821.2.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #64821 Custom Exceptions crash when internal properties overridden (variation 2)
+--FILE--
+<?php
+
+class a extends exception {
+	public function __construct() {
+		$this->line = array();
+	}
+}
+
+throw new a;
+
+?>
+--EXPECTF--
+Fatal error: Uncaught exception 'a' in %s:0
+Stack trace:
+#0 {main}
+  thrown in %s on line %d
diff --git a/Zend/tests/bug64821.3.phpt b/Zend/tests/bug64821.3.phpt
new file mode 100644
index 0000000000..9e96075d49
--- /dev/null
+++ b/Zend/tests/bug64821.3.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #64821 Custom Exceptions crash when internal properties overridden (variation 3)
+--FILE--
+<?php
+
+class a extends exception {
+	public function __construct() {
+		$this->line = array();
+		$this->file = NULL;
+	}
+}
+
+throw new a;
+
+?>
+--EXPECTF--
+Fatal error: Uncaught exception 'a' in :0
+Stack trace:
+#0 {main}
+  thrown in Unknown on line %d
diff --git a/Zend/zend_exceptions.c b/Zend/zend_exceptions.c
index 08a8dbaa05..6a20b843c9 100644
--- a/Zend/zend_exceptions.c
+++ b/Zend/zend_exceptions.c
@@ -803,6 +803,10 @@ ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {
 			if (instanceof_function(ce_exception, default_exception_ce TSRMLS_CC)) {
 				file = zend_read_property(default_exception_ce, EG(exception), "file", sizeof("file")-1, 1 TSRMLS_CC);
 				line = zend_read_property(default_exception_ce, EG(exception), "line", sizeof("line")-1, 1 TSRMLS_CC);
+
+				convert_to_string(file);
+				file = (Z_STRLEN_P(file) > 0) ? file : NULL;
+				line = (Z_TYPE_P(line) == IS_LONG) ? line : NULL;
 			} else {
 				file = NULL;
 				line = NULL;
@@ -814,7 +818,11 @@ ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {
 		file = zend_read_property(default_exception_ce, exception, "file", sizeof("file")-1, 1 TSRMLS_CC);
 		line = zend_read_property(default_exception_ce, exception, "line", sizeof("line")-1, 1 TSRMLS_CC);
 
-		zend_error_va(severity, Z_STRVAL_P(file), Z_LVAL_P(line), "Uncaught %s\n  thrown", Z_STRVAL_P(str));
+		convert_to_string(str);
+		convert_to_string(file);
+		convert_to_long(line);
+
+		zend_error_va(severity, (Z_STRLEN_P(file) > 0) ? Z_STRVAL_P(file) : NULL, Z_LVAL_P(line), "Uncaught %s\n  thrown", Z_STRVAL_P(str));
 	} else {
 		zend_error(severity, "Uncaught exception '%s'", ce_exception->name);
 	}