diff options
| author | Xinchen Hui <laruence@gmail.com> | 2020-02-10 13:02:45 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2020-02-10 13:02:45 +0800 |
| commit | 421a7342fe5a10de38cad88e30c0f0ccdab1292b (patch) | |
| tree | 0769aded614eec950c73e7f96b469f181759526d | |
| parent | 86780ff79f041e2507b90f65145d87d493de89e5 (diff) | |
| parent | 6295ff77b780705d132b15990c2904d2fe596e57 (diff) | |
| download | php-git-421a7342fe5a10de38cad88e30c0f0ccdab1292b.tar.gz | |
Merge branch 'PHP-7.4'
* PHP-7.4:
Fixed bug #79244 (php crashes during parsing INI file). (Laruence)
| -rw-r--r-- | Zend/tests/bug77589.phpt | 40 | ||||
| -rw-r--r-- | Zend/zend_ini_scanner.l | 15 |
2 files changed, 48 insertions, 7 deletions
diff --git a/Zend/tests/bug77589.phpt b/Zend/tests/bug77589.phpt new file mode 100644 index 0000000000..ad07ee1351 --- /dev/null +++ b/Zend/tests/bug77589.phpt @@ -0,0 +1,40 @@ +--TEST-- +BUG #77589 (Core dump using parse_ini_string with numeric sections) +--FILE-- +<?php +var_dump( + parse_ini_string(<<<INI +[0] +a = 1 +b = on +c = true + +["true"] +a = 100 +b = null +c = yes +INI +, TRUE, INI_SCANNER_TYPED)); + +?> +--EXPECT-- +array(2) { + [0]=> + array(3) { + ["a"]=> + int(1) + ["b"]=> + bool(true) + ["c"]=> + bool(true) + } + ["true"]=> + array(3) { + ["a"]=> + int(100) + ["b"]=> + NULL + ["c"]=> + bool(true) + } +} diff --git a/Zend/zend_ini_scanner.l b/Zend/zend_ini_scanner.l index f71f0b9193..1f4bc34742 100644 --- a/Zend/zend_ini_scanner.l +++ b/Zend/zend_ini_scanner.l @@ -141,13 +141,14 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals; ZVAL_NEW_STR(retval, zend_string_init(str, len, ZEND_SYSTEM_INI)) -#define RETURN_TOKEN(type, str, len) { \ - if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED) { \ - zend_ini_copy_typed_value(ini_lval, type, str, len); \ - } else { \ - zend_ini_copy_value(ini_lval, str, len); \ - } \ - return type; \ +#define RETURN_TOKEN(type, str, len) { \ + if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED && \ + (YYSTATE == STATE(ST_VALUE) || YYSTATE == STATE(ST_RAW))) {\ + zend_ini_copy_typed_value(ini_lval, type, str, len); \ + } else { \ + zend_ini_copy_value(ini_lval, str, len); \ + } \ + return type; \ } static inline int convert_to_number(zval *retval, const char *str, const int str_len) |