diff options
| author | Anatol Belski <ab@php.net> | 2018-03-10 11:18:21 +0100 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2018-03-10 11:18:21 +0100 |
| commit | 8417a239731158b7a8585f323e2c9216cac13c85 (patch) | |
| tree | e36db98b162933f138f5f56a29dc981a8abc2db5 | |
| parent | f1b358c9a928e28e58bb23c5d5baa723df4638e0 (diff) | |
| download | php-git-8417a239731158b7a8585f323e2c9216cac13c85.tar.gz | |
Fixed bug #76068 parse_ini_string fails to parse "[foo]\nbar=1|>baz" with segfault
| -rw-r--r-- | Zend/zend_ini_parser.y | 16 | ||||
| -rw-r--r-- | ext/standard/tests/general_functions/parse_ini_string_bug76068.phpt | 49 |
2 files changed, 61 insertions, 4 deletions
diff --git a/Zend/zend_ini_parser.y b/Zend/zend_ini_parser.y index 90db76a94b..e39d93d294 100644 --- a/Zend/zend_ini_parser.y +++ b/Zend/zend_ini_parser.y @@ -57,11 +57,19 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2) int str_len; char str_result[MAX_LENGTH_OF_LONG+1]; - i_op1 = atoi(Z_STRVAL_P(op1)); - zend_string_free(Z_STR_P(op1)); + if (IS_LONG == Z_TYPE_P(op1)) { + i_op1 = Z_LVAL_P(op1); + } else { + i_op1 = atoi(Z_STRVAL_P(op1)); + zend_string_free(Z_STR_P(op1)); + } if (op2) { - i_op2 = atoi(Z_STRVAL_P(op2)); - zend_string_free(Z_STR_P(op2)); + if (IS_LONG == Z_TYPE_P(op2)) { + i_op2 = Z_LVAL_P(op2); + } else { + i_op2 = atoi(Z_STRVAL_P(op2)); + zend_string_free(Z_STR_P(op2)); + } } else { i_op2 = 0; } diff --git a/ext/standard/tests/general_functions/parse_ini_string_bug76068.phpt b/ext/standard/tests/general_functions/parse_ini_string_bug76068.phpt new file mode 100644 index 0000000000..8362fb84d1 --- /dev/null +++ b/ext/standard/tests/general_functions/parse_ini_string_bug76068.phpt @@ -0,0 +1,49 @@ +--TEST-- +Bug #76068 parse_ini_string fails to parse "[foo]\nbar=1|>baz" with segfault +--FILE-- +<?php + +$s = parse_ini_string("[foo]\nbar=1|>baz",true, \INI_SCANNER_TYPED); +var_dump($s); + +$s = parse_ini_string("[foo]\nbar=\"1|>baz\"",true, \INI_SCANNER_TYPED); +var_dump($s); + +$s = parse_ini_string("[foo]\nbar=1",true, \INI_SCANNER_TYPED); +var_dump($s); + +$s = parse_ini_string("[foo]\nbar=42|>baz",true, \INI_SCANNER_TYPED); +var_dump($s); + +?> +==DONE== +--EXPECT-- +array(1) { + ["foo"]=> + array(1) { + ["bar"]=> + string(1) "1" + } +} +array(1) { + ["foo"]=> + array(1) { + ["bar"]=> + string(6) "1|>baz" + } +} +array(1) { + ["foo"]=> + array(1) { + ["bar"]=> + int(1) + } +} +array(1) { + ["foo"]=> + array(1) { + ["bar"]=> + string(2) "42" + } +} +==DONE== |