diff options
| author | Stanislav Malyshev <stas@php.net> | 2015-01-31 22:40:08 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2015-02-17 06:43:51 +0100 |
| commit | 7b1898183032eeabc64a086ff040af991cebcd93 (patch) | |
| tree | 81778340a2d8687fcfdd879894da2ffa5d8960a2 /ext/date/php_date.c | |
| parent | 82d347a477e2b7c0001c9b58d0b67048ed63af04 (diff) | |
| download | php-git-7b1898183032eeabc64a086ff040af991cebcd93.tar.gz | |
Fix bug #68942 (Use after free vulnerability in unserialize() with DateTimeZone)
Conflicts:
ext/date/php_date.c
Diffstat (limited to 'ext/date/php_date.c')
| -rw-r--r-- | ext/date/php_date.c | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/ext/date/php_date.c b/ext/date/php_date.c index 92e9480a43..08bfd0899b 100644 --- a/ext/date/php_date.c +++ b/ext/date/php_date.c @@ -2575,12 +2575,9 @@ static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht timelib_tzinfo *tzi; php_timezone_obj *tzobj; - if (zend_hash_find(myht, "date", 5, (void**) &z_date) == SUCCESS) { - convert_to_string(*z_date); - if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS) { - convert_to_long(*z_timezone_type); - if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS) { - convert_to_string(*z_timezone); + if (zend_hash_find(myht, "date", 5, (void**) &z_date) == SUCCESS && Z_TYPE_PP(z_date) == IS_STRING) { + if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS && Z_TYPE_PP(z_timezone_type) == IS_LONG) { + if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS && Z_TYPE_PP(z_timezone) == IS_STRING) { switch (Z_LVAL_PP(z_timezone_type)) { case TIMELIB_ZONETYPE_OFFSET: @@ -2595,7 +2592,6 @@ static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht case TIMELIB_ZONETYPE_ID: { int ret; - convert_to_string(*z_timezone); tzi = php_date_parse_tzfile(Z_STRVAL_PP(z_timezone), DATE_TIMEZONEDB TSRMLS_CC); |