diff options
| author | Xinchen Hui <laruence@gmail.com> | 2016-03-23 16:16:26 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2016-03-23 16:16:26 +0800 |
| commit | a3946de3397fa081226d74210d726af0f69ef82f (patch) | |
| tree | 10af68bafab4c98879c72f9b4b279705d920c82d | |
| parent | 241ba9dcb195160e323847757413603a3cc72a1f (diff) | |
| download | php-git-a3946de3397fa081226d74210d726af0f69ef82f.tar.gz | |
Fixed Bug #71884 (Null pointer deref (segfault) in stream_context_get_default)
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/standard/streamsfuncs.c | 5 | ||||
| -rw-r--r-- | ext/standard/tests/streams/bug71884.phpt | 10 |
3 files changed, 14 insertions, 3 deletions
@@ -45,6 +45,8 @@ PHP NEWS . Fixed bug #71735 (Double-free in SplDoublyLinkedList::offsetSet). (Stas) - Standard: + . Fixed bug #71884 (Null pointer deref (segfault) in + stream_context_get_default). (Laruence) . Fixed bug #71837 (Wrong arrays behaviour). (Laruence) . Fixed bug #71840 (Unserialize accepts wrongly data). (Ryat, Laruence) diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c index c2f200eedd..def1fb88d7 100644 --- a/ext/standard/streamsfuncs.c +++ b/ext/standard/streamsfuncs.c @@ -883,13 +883,12 @@ static int parse_context_options(php_stream_context *context, zval *options) ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(options), wkey, wval) { ZVAL_DEREF(wval); - if (Z_TYPE_P(wval) == IS_ARRAY) { - ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(wval), okey, oval) { + if (wkey && Z_TYPE_P(wval) == IS_ARRAY) { + ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(wval), okey, oval) { if (okey) { php_stream_context_set_option(context, ZSTR_VAL(wkey), ZSTR_VAL(okey), oval); } } ZEND_HASH_FOREACH_END(); - } else { php_error_docref(NULL, E_WARNING, "options should have the form [\"wrappername\"][\"optionname\"] = $value"); } diff --git a/ext/standard/tests/streams/bug71884.phpt b/ext/standard/tests/streams/bug71884.phpt new file mode 100644 index 0000000000..798c6b6431 --- /dev/null +++ b/ext/standard/tests/streams/bug71884.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #71884 (Null pointer deref (segfault) in stream_context_get_default) +--FILE-- +<?php +$arr=array(); +$arr[0]['A']=0; +stream_context_get_default($arr); +?> +--EXPECTF-- +Warning: stream_context_get_default(): options should have the form ["wrappername"]["optionname"] = $value in %sbug71884.php on line %d |