MFH: - Fixed bug #43196 (array_intersect_assoc() crashes with non-array input)

1 files changed, 38 insertions, 4 deletions

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 0b5b698891..2b241604d2 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2763,13 +2763,24 @@ static void php_array_intersect_key(INTERNAL_FUNCTION_PARAMETERS, int data_compa
 		}
 	}
 
+	if (Z_TYPE_PP(args[0]) != IS_ARRAY) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Argument #1 is not an array");
+		RETVAL_NULL();
+		goto out;
+	}
+
 	array_init(return_value);
 
 	for (p = Z_ARRVAL_PP(args[0])->pListHead; p != NULL; p = p->pListNext) {
 		if (p->nKeyLength == 0) {
 			ok = 1;
 			for (i = 1; i < argc; i++) {
-				if (zend_hash_index_find(Z_ARRVAL_PP(args[i]), p->h, (void**)&data) == FAILURE ||
+				if (Z_TYPE_PP(args[i]) != IS_ARRAY) {
+					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Argument #%d is not an array", i + 1);
+					zval_dtor(return_value);
+					RETVAL_NULL();
+					goto out;
+				} else if (zend_hash_index_find(Z_ARRVAL_PP(args[i]), p->h, (void**)&data) == FAILURE ||
 					(intersect_data_compare_func &&
 					intersect_data_compare_func((zval**)p->pData, data TSRMLS_CC) != 0)
 				) {
@@ -2784,7 +2795,12 @@ static void php_array_intersect_key(INTERNAL_FUNCTION_PARAMETERS, int data_compa
 		} else {
 			ok = 1;
 			for (i = 1; i < argc; i++) {
-				if (zend_hash_quick_find(Z_ARRVAL_PP(args[i]), p->arKey, p->nKeyLength, p->h, (void**)&data) == FAILURE ||
+				if (Z_TYPE_PP(args[i]) != IS_ARRAY) {
+					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Argument #%d is not an array", i + 1);
+					zval_dtor(return_value);
+					RETVAL_NULL();
+					goto out;
+				} else if (zend_hash_quick_find(Z_ARRVAL_PP(args[i]), p->arKey, p->nKeyLength, p->h, (void**)&data) == FAILURE ||
 					(intersect_data_compare_func &&
 					intersect_data_compare_func((zval**)p->pData, data TSRMLS_CC) != 0)
 				) {
@@ -2798,6 +2814,7 @@ static void php_array_intersect_key(INTERNAL_FUNCTION_PARAMETERS, int data_compa
 			}
 		}
 	}
+out:
 	efree(args);
 }
 /* }}} */
@@ -3164,13 +3181,24 @@ static void php_array_diff_key(INTERNAL_FUNCTION_PARAMETERS, int data_compare_ty
 		}
 	}
 
+	if (Z_TYPE_PP(args[0]) != IS_ARRAY) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Argument #1 is not an array");
+		RETVAL_NULL();
+		goto out;
+	}
+
 	array_init(return_value);
 
 	for (p = Z_ARRVAL_PP(args[0])->pListHead; p != NULL; p = p->pListNext) {
 		if (p->nKeyLength == 0) {
 			ok = 1;
 			for (i = 1; i < argc; i++) {
-				if (zend_hash_index_find(Z_ARRVAL_PP(args[i]), p->h, (void**)&data) == SUCCESS &&
+				if (Z_TYPE_PP(args[i]) != IS_ARRAY) {
+					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Argument #%d is not an array", i + 1);
+					zval_dtor(return_value);
+					RETVAL_NULL();
+					goto out;
+				} else if (zend_hash_index_find(Z_ARRVAL_PP(args[i]), p->h, (void**)&data) == SUCCESS &&
 					(!diff_data_compare_func ||
 					diff_data_compare_func((zval**)p->pData, data TSRMLS_CC) == 0)
 				) {
@@ -3185,7 +3213,12 @@ static void php_array_diff_key(INTERNAL_FUNCTION_PARAMETERS, int data_compare_ty
 		} else {
 			ok = 1;
 			for (i = 1; i < argc; i++) {
-				if (zend_hash_quick_find(Z_ARRVAL_PP(args[i]), p->arKey, p->nKeyLength, p->h, (void**)&data) == SUCCESS &&
+				if (Z_TYPE_PP(args[i]) != IS_ARRAY) {
+					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Argument #%d is not an array", i + 1);
+					zval_dtor(return_value);
+					RETVAL_NULL();
+					goto out;
+				} else if (zend_hash_quick_find(Z_ARRVAL_PP(args[i]), p->arKey, p->nKeyLength, p->h, (void**)&data) == SUCCESS &&
 					(!diff_data_compare_func ||
 					diff_data_compare_func((zval**)p->pData, data TSRMLS_CC) == 0)
 				) {
@@ -3199,6 +3232,7 @@ static void php_array_diff_key(INTERNAL_FUNCTION_PARAMETERS, int data_compare_ty
 			}
 		}
 	}
+out:
 	efree(args);
 }
 /* }}} */