diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2020-10-26 11:55:10 +0100 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-10-26 11:55:29 +0100 |
| commit | 2da00fadc8feff97214fa9f8845fa7bd7bb4cba5 (patch) | |
| tree | 098a7a65fde7efef39d714ec26e892d242ce6172 | |
| parent | 0abcb9fb695dd14de89eeb76002412556d7757b4 (diff) | |
| parent | f9ba2ca1360531bc6f8ff26ac3ade7c498685f31 (diff) | |
| download | php-git-2da00fadc8feff97214fa9f8845fa7bd7bb4cba5.tar.gz | |
Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
Fix #62474: com_event_sink crashes on certain arguments
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/com_dotnet/com_typeinfo.c | 44 | ||||
| -rw-r--r-- | ext/com_dotnet/tests/bug62474.phpt | 14 |
3 files changed, 41 insertions, 20 deletions
@@ -10,6 +10,9 @@ PHP NEWS . Fixed bug #80258 (Windows Deduplication Enabled, randon permission errors). (cmb) +- COM: + . Fixed bug #62474 (com_event_sink crashes on certain arguments). (cmb) + - IMAP: . Fixed bug #76618 (segfault on imap_reopen). (girgias) . Fixed bug #80239 (imap_rfc822_write_address() leaks memory). (cmb) diff --git a/ext/com_dotnet/com_typeinfo.c b/ext/com_dotnet/com_typeinfo.c index a036526d8b..862a1263a5 100644 --- a/ext/com_dotnet/com_typeinfo.c +++ b/ext/com_dotnet/com_typeinfo.c @@ -306,18 +306,20 @@ ITypeInfo *php_com_locate_typeinfo(char *typelibname, php_com_dotnet_object *obj if (obj) { if (dispname == NULL && sink) { - IProvideClassInfo2 *pci2; - IProvideClassInfo *pci; + if (V_VT(&obj->v) == VT_DISPATCH) { + IProvideClassInfo2 *pci2; + IProvideClassInfo *pci; - if (SUCCEEDED(IDispatch_QueryInterface(V_DISPATCH(&obj->v), &IID_IProvideClassInfo2, (void**)&pci2))) { - gotguid = SUCCEEDED(IProvideClassInfo2_GetGUID(pci2, GUIDKIND_DEFAULT_SOURCE_DISP_IID, &iid)); - IProvideClassInfo2_Release(pci2); - } - if (!gotguid && SUCCEEDED(IDispatch_QueryInterface(V_DISPATCH(&obj->v), &IID_IProvideClassInfo, (void**)&pci))) { - /* examine the available interfaces */ - /* TODO: write some code here */ - php_error_docref(NULL, E_WARNING, "IProvideClassInfo: this code not yet written!"); - IProvideClassInfo_Release(pci); + if (SUCCEEDED(IDispatch_QueryInterface(V_DISPATCH(&obj->v), &IID_IProvideClassInfo2, (void**)&pci2))) { + gotguid = SUCCEEDED(IProvideClassInfo2_GetGUID(pci2, GUIDKIND_DEFAULT_SOURCE_DISP_IID, &iid)); + IProvideClassInfo2_Release(pci2); + } + if (!gotguid && SUCCEEDED(IDispatch_QueryInterface(V_DISPATCH(&obj->v), &IID_IProvideClassInfo, (void**)&pci))) { + /* examine the available interfaces */ + /* TODO: write some code here */ + php_error_docref(NULL, E_WARNING, "IProvideClassInfo: this code not yet written!"); + IProvideClassInfo_Release(pci); + } } } else if (dispname == NULL) { if (obj->typeinfo) { @@ -334,15 +336,17 @@ ITypeInfo *php_com_locate_typeinfo(char *typelibname, php_com_dotnet_object *obj /* get the library from the object; the rest will be dealt with later */ ITypeInfo_GetContainingTypeLib(obj->typeinfo, &typelib, &idx); } else if (typelibname == NULL) { - IDispatch_GetTypeInfo(V_DISPATCH(&obj->v), 0, LANG_NEUTRAL, &typeinfo); - if (dispname) { - unsigned int idx; - /* get the library from the object; the rest will be dealt with later */ - ITypeInfo_GetContainingTypeLib(typeinfo, &typelib, &idx); - - if (typelib) { - ITypeInfo_Release(typeinfo); - typeinfo = NULL; + if (V_VT(&obj->v) == VT_DISPATCH) { + IDispatch_GetTypeInfo(V_DISPATCH(&obj->v), 0, LANG_NEUTRAL, &typeinfo); + if (dispname) { + unsigned int idx; + /* get the library from the object; the rest will be dealt with later */ + ITypeInfo_GetContainingTypeLib(typeinfo, &typelib, &idx); + + if (typelib) { + ITypeInfo_Release(typeinfo); + typeinfo = NULL; + } } } } diff --git a/ext/com_dotnet/tests/bug62474.phpt b/ext/com_dotnet/tests/bug62474.phpt new file mode 100644 index 0000000000..cc8e252224 --- /dev/null +++ b/ext/com_dotnet/tests/bug62474.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #62474 (com_event_sink crashes on certain arguments) +--SKIPIF-- +<?php +if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available'); +?> +--FILE-- +<?php +var_dump(com_event_sink(new variant, function() {}, array())); +var_dump(com_event_sink(new variant, new variant, 'a')); +?> +--EXPECT-- +bool(false) +bool(false) |