diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2006-01-02 22:19:37 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2006-01-02 22:19:37 +0000 |
| commit | a5e15f2e1c5bb5507269fa18174ea195e9c0c8d9 (patch) | |
| tree | 2f45f2908bed63509c02ca324963650a356f1ba4 /sapi/apache2handler/php_functions.c | |
| parent | 6d8c69e3cb0c77d090b771a39408e3999a526312 (diff) | |
| download | php-git-a5e15f2e1c5bb5507269fa18174ea195e9c0c8d9.tar.gz | |
Fixed possible crash in apache_getenv()/apache_setenv() on invalid
parameters.
Diffstat (limited to 'sapi/apache2handler/php_functions.c')
| -rw-r--r-- | sapi/apache2handler/php_functions.c | 22 |
1 files changed, 14 insertions, 8 deletions
diff --git a/sapi/apache2handler/php_functions.c b/sapi/apache2handler/php_functions.c index fc987ec531..2df54c5d45 100644 --- a/sapi/apache2handler/php_functions.c +++ b/sapi/apache2handler/php_functions.c @@ -264,10 +264,13 @@ PHP_FUNCTION(apache_setenv) ctx = SG(server_context); r = ctx->r; - if (arg_count == 3 && Z_STRVAL_PP(walk_to_top)) { - while(r->prev) { - r = r->prev; - } + if (arg_count == 3) { + convert_to_boolean_ex(walk_to_top); + if (Z_LVAL_PP(walk_to_top)) { + while(r->prev) { + r = r->prev; + } + } } convert_to_string_ex(variable); @@ -300,10 +303,13 @@ PHP_FUNCTION(apache_getenv) ctx = SG(server_context); r = ctx->r; - if (arg_count == 2 && Z_STRVAL_PP(walk_to_top)) { - while(r->prev) { - r = r->prev; - } + if (arg_count == 2) { + convert_to_boolean_ex(walk_to_top); + if (Z_LVAL_PP(walk_to_top)) { + while(r->prev) { + r = r->prev; + } + } } convert_to_string_ex(variable); |