diff options
| author | Xinchen Hui <laruence@gmail.com> | 2016-05-31 11:44:20 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2016-05-31 11:44:20 +0800 |
| commit | d1dd9b4558e9c1b2e86887f99c009063ee3eb5f4 (patch) | |
| tree | 944e26774e57e57ef10f58080237b5f865541934 /ext | |
| parent | a811b5e38d9ccbbce70658c9bc59515bf9208019 (diff) | |
| download | php-git-d1dd9b4558e9c1b2e86887f99c009063ee3eb5f4.tar.gz | |
Re-Fixed bug #72155 (use-after-free caused by get_zval_xmlrpc_type)
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/xmlrpc/tests/bug72155.phpt | 22 | ||||
| -rw-r--r-- | ext/xmlrpc/xmlrpc-epi-php.c | 2 |
2 files changed, 23 insertions, 1 deletions
diff --git a/ext/xmlrpc/tests/bug72155.phpt b/ext/xmlrpc/tests/bug72155.phpt new file mode 100644 index 0000000000..38c90be252 --- /dev/null +++ b/ext/xmlrpc/tests/bug72155.phpt @@ -0,0 +1,22 @@ +--TEST-- +Bug #72155 (use-after-free caused by get_zval_xmlrpc_type) +--SKIPIF-- +<?php +if (!extension_loaded("xmlrpc")) print "skip"; +?> +--FILE-- +<?php +$var0 = fopen("/etc/passwd","r"); +$var1 = xmlrpc_encode($var0); +var_dump($var1); +?> +--EXPECTF-- +string(109) "<?xml version="1.0" encoding="utf-8"?> +<params> +<param> + <value> + <int>5</int> + </value> +</param> +</params> +" diff --git a/ext/xmlrpc/xmlrpc-epi-php.c b/ext/xmlrpc/xmlrpc-epi-php.c index ea62bdc9a9..b5dcee8f0d 100644 --- a/ext/xmlrpc/xmlrpc-epi-php.c +++ b/ext/xmlrpc/xmlrpc-epi-php.c @@ -535,7 +535,7 @@ static XMLRPC_VALUE PHP_to_XMLRPC_worker (const char* key, zval* in_val, int dep xReturn = XMLRPC_CreateValueBoolean(key, Z_TYPE(val) == IS_TRUE); break; case xmlrpc_int: - convert_to_long(&val); + ZVAL_LONG(&val, zval_get_long(&val)); xReturn = XMLRPC_CreateValueInt(key, Z_LVAL(val)); break; case xmlrpc_double: |