diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2016-08-17 00:41:31 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2016-08-17 00:42:45 +0200 |
| commit | 1bb92d52121cf2635df163911216bf2958db4d34 (patch) | |
| tree | 3b2c22da77eaf4fc149872c138f834df9ed8b8e1 /ext/xml/xml.c | |
| parent | 4a4422740f917f46e0860024667042733f61152b (diff) | |
| download | php-git-1bb92d52121cf2635df163911216bf2958db4d34.tar.gz | |
#72085: SEGV on unknown address zif_xml_parse
We better make sure that the ZVALs we're accessing as arrays are indeed
arrays.
Diffstat (limited to 'ext/xml/xml.c')
| -rw-r--r-- | ext/xml/xml.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/ext/xml/xml.c b/ext/xml/xml.c index 0850f0c605..9eba47be26 100644 --- a/ext/xml/xml.c +++ b/ext/xml/xml.c @@ -535,7 +535,8 @@ static zval *xml_call_handler(xml_parser *parser, zval *handler, zend_function * if (Z_TYPE_P(handler) == IS_STRING) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to call handler %s()", Z_STRVAL_P(handler)); - } else if (zend_hash_index_find(Z_ARRVAL_P(handler), 0, (void **) &obj) == SUCCESS && + } else if (Z_TYPE_P(handler) == IS_ARRAY && + zend_hash_index_find(Z_ARRVAL_P(handler), 0, (void **) &obj) == SUCCESS && zend_hash_index_find(Z_ARRVAL_P(handler), 1, (void **) &method) == SUCCESS && Z_TYPE_PP(obj) == IS_OBJECT && Z_TYPE_PP(method) == IS_STRING) { |