Fix #60192 SegFault when Collator not constructed properly

8 files changed, 122 insertions, 0 deletions

diff --git a/ext/intl/collator/collator_compare.c b/ext/intl/collator/collator_compare.c
index 840855661c..f7d01949cc 100755
--- a/ext/intl/collator/collator_compare.c
+++ b/ext/intl/collator/collator_compare.c
@@ -99,6 +99,10 @@ PHP_FUNCTION( collator_compare )
 		RETURN_FALSE;
 	}
 
+	if (!co || !co->ucoll) {
+	php_error_docref(NULL TSRMLS_CC, E_ERROR, "Object not initialized");
+	}
+
 	/* Then compare them. */
 	result = ucol_strcoll(
 		co->ucoll,
diff --git a/ext/intl/collator/collator_locale.c b/ext/intl/collator/collator_locale.c
index 331fed22fc..eaa7e6ba35 100755
--- a/ext/intl/collator/collator_locale.c
+++ b/ext/intl/collator/collator_locale.c
@@ -51,6 +51,10 @@ PHP_FUNCTION( collator_get_locale )
 	/* Fetch the object. */
 	COLLATOR_METHOD_FETCH_OBJECT;
 
+	if (!co || !co->ucoll) {
+		php_error_docref(NULL TSRMLS_CC, E_ERROR, "Object not initialized");
+	}
+
 	/* Get locale by specified type. */
 	locale_name = (char*) ucol_getLocaleByType(
 		co->ucoll, type, COLLATOR_ERROR_CODE_P( co ) );
diff --git a/ext/intl/collator/collator_sort.c b/ext/intl/collator/collator_sort.c
index 929a9c09d5..a8fbd18e5e 100755
--- a/ext/intl/collator/collator_sort.c
+++ b/ext/intl/collator/collator_sort.c
@@ -73,6 +73,10 @@ static int collator_regular_compare_function(zval *result, zval *op1, zval *op2
 		/* Fetch collator object. */
 		co = (Collator_object *) zend_object_store_get_object( INTL_G(current_collator) TSRMLS_CC );
 
+	if (!co || !co->ucoll) {
+		php_error_docref(NULL TSRMLS_CC, E_ERROR, "Object not initialized");
+	}
+
 		/* Compare the strings using ICU. */
 		result->value.lval = ucol_strcoll(
 				co->ucoll,
@@ -441,6 +445,10 @@ PHP_FUNCTION( collator_sort_with_sort_keys )
 		/* Get sort key, reallocating the buffer if needed. */
 		bufLeft = sortKeyBufSize - sortKeyBufOffset;
 
+		if (!co || !co->ucoll) {
+			php_error_docref(NULL TSRMLS_CC, E_ERROR, "Object not initialized");
+		}
+
 		sortKeyLen = ucol_getSortKey( co->ucoll,
 									  utf16_buf,
 									  utf16_len,
@@ -571,6 +579,10 @@ PHP_FUNCTION( collator_get_sort_key )
 		RETURN_FALSE;
 	}
 
+	if (!co || !co->ucoll) {
+		php_error_docref(NULL TSRMLS_CC, E_ERROR, "Object not initialized");
+	}
+
 	key_len = ucol_getSortKey(co->ucoll, ustr, ustr_len, key, 0);
 	if(!key_len) {
 		efree( ustr );
diff --git a/ext/intl/tests/bug60192-compare.phpt b/ext/intl/tests/bug60192-compare.phpt
new file mode 100644
index 0000000000..d1db015d4a
--- /dev/null
+++ b/ext/intl/tests/bug60192-compare.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #60192 (SegFault when Collator not constructed properly)
+--SKIPIF--
+<?php
+	if (!extension_loaded('intl')) { die('skip intl extension not available'); }
+?>
+--FILE--
+<?php
+
+class Collator2 extends Collator{
+	public function __construct() {
+		// ommitting parent::__construct($someLocale);
+	}
+}
+
+$c = new Collator2();
+$c->compare('h', 'H');
+--EXPECTF--
+
+Fatal error: Collator::compare(): Object not initialized in %s on line %d
diff --git a/ext/intl/tests/bug60192-getlocale.phpt b/ext/intl/tests/bug60192-getlocale.phpt
new file mode 100644
index 0000000000..0adb09223b
--- /dev/null
+++ b/ext/intl/tests/bug60192-getlocale.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #60192 (SegFault when Collator not constructed properly)
+--SKIPIF--
+<?php
+	if (!extension_loaded('intl')) { die('skip intl extension not available'); }
+?>
+--FILE--
+<?php
+
+class Collator2 extends Collator{
+	public function __construct() {
+		// ommitting parent::__construct($someLocale);
+	}
+}
+
+$c = new Collator2();
+$c->getLocale(Locale::ACTUAL_LOCALE);
+--EXPECTF--
+
+Fatal error: Collator::getLocale(): Object not initialized in %s on line %d
diff --git a/ext/intl/tests/bug60192-getsortkey.phpt b/ext/intl/tests/bug60192-getsortkey.phpt
new file mode 100644
index 0000000000..dedcfab8ba
--- /dev/null
+++ b/ext/intl/tests/bug60192-getsortkey.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #60192 (SegFault when Collator not constructed properly)
+--SKIPIF--
+<?php
+	if (!extension_loaded('intl')) { die('skip intl extension not available'); }
+?>
+--FILE--
+<?php
+
+class Collator2 extends Collator{
+	public function __construct() {
+		// ommitting parent::__construct($someLocale);
+	}
+}
+
+$c = new Collator2();
+$c->getSortKey('h');
+--EXPECTF--
+
+Fatal error: Collator::getSortKey(): Object not initialized in %s on line %d
diff --git a/ext/intl/tests/bug60192-sort.phpt b/ext/intl/tests/bug60192-sort.phpt
new file mode 100644
index 0000000000..35158995b6
--- /dev/null
+++ b/ext/intl/tests/bug60192-sort.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #60192 (SegFault when Collator not constructed properly)
+--SKIPIF--
+<?php
+	if (!extension_loaded('intl')) { die('skip intl extension not available'); }
+?>
+--FILE--
+<?php
+
+class Collator2 extends Collator{
+	public function __construct() {
+		// ommitting parent::__construct($someLocale);
+	}
+}
+
+$c = new Collator2();
+$a = array('a', 'b');
+$c->sort($a);
+--EXPECTF--
+
+Fatal error: Collator::sort(): Object not initialized in %s on line %d
diff --git a/ext/intl/tests/bug60192-sortwithsortkeys.phpt b/ext/intl/tests/bug60192-sortwithsortkeys.phpt
new file mode 100644
index 0000000000..a82fdda79a
--- /dev/null
+++ b/ext/intl/tests/bug60192-sortwithsortkeys.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #60192 (SegFault when Collator not constructed properly)
+--SKIPIF--
+<?php
+	if (!extension_loaded('intl')) { die('skip intl extension not available'); }
+?>
+--FILE--
+<?php
+
+class Collator2 extends Collator{
+	public function __construct() {
+		// ommitting parent::__construct($someLocale);
+	}
+}
+
+$c = new Collator2();
+$a = array('a', 'b');
+$c->sortWithSortKeys($a);
+--EXPECTF--
+
+Fatal error: Collator::sortWithSortKeys(): Object not initialized in %s on line %d