diff options
| author | Xinchen Hui <laruence@gmail.com> | 2016-11-16 15:05:04 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2016-11-16 15:05:04 +0800 |
| commit | 229024c7250d0a11fe9a83094a7e30b6fb83ad90 (patch) | |
| tree | 03cd09086eb480cb496118a31c12fb5ddad56e1e | |
| parent | d6c36e9af7ce43445b823e9a3b96868cf60fa7ed (diff) | |
| download | php-git-229024c7250d0a11fe9a83094a7e30b6fb83ad90.tar.gz | |
Fixed bug #73532 (Null pointer dereference in mb_eregi)
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/mbstring/php_mbregex.c | 6 | ||||
| -rw-r--r-- | ext/mbstring/tests/bug73532.phpt | 8 |
3 files changed, 15 insertions, 2 deletions
@@ -8,6 +8,9 @@ PHP NEWS - Date: . Fixed bug #69587 (DateInterval properties and isset). (jhdxr) +- Mbstring: + . Fixed bug #73532 (Null pointer dereference in mb_eregi). (Laruence) + - SQLite3: . Update to SQLite 3.15.1. (cmb) diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c index a9e464fa64..cf341d3599 100644 --- a/ext/mbstring/php_mbregex.c +++ b/ext/mbstring/php_mbregex.c @@ -708,8 +708,10 @@ static void _php_mb_regex_ereg_exec(INTERNAL_FUNCTION_PARAMETERS, int icase) string_len, _php_mb_regex_mbctype2name(MBREX(current_mbctype)) )) { - zval_dtor(array); - array_init(array); + if (array != NULL) { + zval_dtor(array); + array_init(array); + } RETURN_FALSE; } diff --git a/ext/mbstring/tests/bug73532.phpt b/ext/mbstring/tests/bug73532.phpt new file mode 100644 index 0000000000..0bc838b075 --- /dev/null +++ b/ext/mbstring/tests/bug73532.phpt @@ -0,0 +1,8 @@ +--TEST-- +Bug #73532 (Null pointer dereference in mb_eregi) +--FILE-- +<?php +var_dump(mb_eregi("a", "\xf5")); +?> +--EXPECTF-- +bool(false) |