diff options
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/standard/streamsfuncs.c | 5 | ||||
| -rw-r--r-- | ext/standard/tests/streams/bug71884.phpt | 10 |
3 files changed, 14 insertions, 3 deletions
@@ -45,6 +45,8 @@ PHP NEWS . Fixed bug #71735 (Double-free in SplDoublyLinkedList::offsetSet). (Stas) - Standard: + . Fixed bug #71884 (Null pointer deref (segfault) in + stream_context_get_default). (Laruence) . Fixed bug #71837 (Wrong arrays behaviour). (Laruence) . Fixed bug #71840 (Unserialize accepts wrongly data). (Ryat, Laruence) diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c index c2f200eedd..def1fb88d7 100644 --- a/ext/standard/streamsfuncs.c +++ b/ext/standard/streamsfuncs.c @@ -883,13 +883,12 @@ static int parse_context_options(php_stream_context *context, zval *options) ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(options), wkey, wval) { ZVAL_DEREF(wval); - if (Z_TYPE_P(wval) == IS_ARRAY) { - ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(wval), okey, oval) { + if (wkey && Z_TYPE_P(wval) == IS_ARRAY) { + ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(wval), okey, oval) { if (okey) { php_stream_context_set_option(context, ZSTR_VAL(wkey), ZSTR_VAL(okey), oval); } } ZEND_HASH_FOREACH_END(); - } else { php_error_docref(NULL, E_WARNING, "options should have the form [\"wrappername\"][\"optionname\"] = $value"); } diff --git a/ext/standard/tests/streams/bug71884.phpt b/ext/standard/tests/streams/bug71884.phpt new file mode 100644 index 0000000000..798c6b6431 --- /dev/null +++ b/ext/standard/tests/streams/bug71884.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #71884 (Null pointer deref (segfault) in stream_context_get_default) +--FILE-- +<?php +$arr=array(); +$arr[0]['A']=0; +stream_context_get_default($arr); +?> +--EXPECTF-- +Warning: stream_context_get_default(): options should have the form ["wrappername"]["optionname"] = $value in %sbug71884.php on line %d |