summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnatol Belski <ab@php.net>2018-03-10 11:18:21 +0100
committerAnatol Belski <ab@php.net>2018-03-10 11:18:21 +0100
commit8417a239731158b7a8585f323e2c9216cac13c85 (patch)
treee36db98b162933f138f5f56a29dc981a8abc2db5
parentf1b358c9a928e28e58bb23c5d5baa723df4638e0 (diff)
downloadphp-git-8417a239731158b7a8585f323e2c9216cac13c85.tar.gz
Fixed bug #76068 parse_ini_string fails to parse "[foo]\nbar=1|>baz" with segfault
-rw-r--r--Zend/zend_ini_parser.y16
-rw-r--r--ext/standard/tests/general_functions/parse_ini_string_bug76068.phpt49
2 files changed, 61 insertions, 4 deletions
diff --git a/Zend/zend_ini_parser.y b/Zend/zend_ini_parser.y
index 90db76a94b..e39d93d294 100644
--- a/Zend/zend_ini_parser.y
+++ b/Zend/zend_ini_parser.y
@@ -57,11 +57,19 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
int str_len;
char str_result[MAX_LENGTH_OF_LONG+1];
- i_op1 = atoi(Z_STRVAL_P(op1));
- zend_string_free(Z_STR_P(op1));
+ if (IS_LONG == Z_TYPE_P(op1)) {
+ i_op1 = Z_LVAL_P(op1);
+ } else {
+ i_op1 = atoi(Z_STRVAL_P(op1));
+ zend_string_free(Z_STR_P(op1));
+ }
if (op2) {
- i_op2 = atoi(Z_STRVAL_P(op2));
- zend_string_free(Z_STR_P(op2));
+ if (IS_LONG == Z_TYPE_P(op2)) {
+ i_op2 = Z_LVAL_P(op2);
+ } else {
+ i_op2 = atoi(Z_STRVAL_P(op2));
+ zend_string_free(Z_STR_P(op2));
+ }
} else {
i_op2 = 0;
}
diff --git a/ext/standard/tests/general_functions/parse_ini_string_bug76068.phpt b/ext/standard/tests/general_functions/parse_ini_string_bug76068.phpt
new file mode 100644
index 0000000000..8362fb84d1
--- /dev/null
+++ b/ext/standard/tests/general_functions/parse_ini_string_bug76068.phpt
@@ -0,0 +1,49 @@
+--TEST--
+Bug #76068 parse_ini_string fails to parse "[foo]\nbar=1|>baz" with segfault
+--FILE--
+<?php
+
+$s = parse_ini_string("[foo]\nbar=1|>baz",true, \INI_SCANNER_TYPED);
+var_dump($s);
+
+$s = parse_ini_string("[foo]\nbar=\"1|>baz\"",true, \INI_SCANNER_TYPED);
+var_dump($s);
+
+$s = parse_ini_string("[foo]\nbar=1",true, \INI_SCANNER_TYPED);
+var_dump($s);
+
+$s = parse_ini_string("[foo]\nbar=42|>baz",true, \INI_SCANNER_TYPED);
+var_dump($s);
+
+?>
+==DONE==
+--EXPECT--
+array(1) {
+ ["foo"]=>
+ array(1) {
+ ["bar"]=>
+ string(1) "1"
+ }
+}
+array(1) {
+ ["foo"]=>
+ array(1) {
+ ["bar"]=>
+ string(6) "1|>baz"
+ }
+}
+array(1) {
+ ["foo"]=>
+ array(1) {
+ ["bar"]=>
+ int(1)
+ }
+}
+array(1) {
+ ["foo"]=>
+ array(1) {
+ ["bar"]=>
+ string(2) "42"
+ }
+}
+==DONE==