From af41914e15c3c67821ad5f9a0caf11f44b938e4b Mon Sep 17 00:00:00 2001 From: Pierre Joye Date: Mon, 10 Mar 2014 12:06:40 +0100 Subject: fix #66872, invalid argument crashes gmp_testbit --- ext/gmp/gmp.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) (limited to 'ext/gmp') diff --git a/ext/gmp/gmp.c b/ext/gmp/gmp.c index 25e8203030..134cc4819a 100644 --- a/ext/gmp/gmp.c +++ b/ext/gmp/gmp.c @@ -1511,25 +1511,23 @@ ZEND_FUNCTION(gmp_clrbit) Tests if bit is set in a */ ZEND_FUNCTION(gmp_testbit) { - zval **a_arg; + zval *a_arg; long index; - mpz_t *gmpnum_a; + mpz_ptr gmpnum_a; + gmp_temp_t temp_a; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Zl", &a_arg, &index) == FAILURE){ + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zl", &a_arg, &index) == FAILURE){ return; } - ZEND_FETCH_RESOURCE(gmpnum_a, mpz_t *, a_arg, -1, GMP_RESOURCE_NAME, le_gmp); - if (index < 0) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Index must be greater than or equal to zero"); RETURN_FALSE; } - if (mpz_tstbit(*gmpnum_a, index)) { - RETURN_TRUE; - } - RETURN_FALSE; + FETCH_GMP_ZVAL(gmpnum_a, a_arg, temp_a); + RETVAL_BOOL(mpz_tstbit(gmpnum_a, index)); + FREE_GMP_TEMP(temp_a); } /* }}} */ -- cgit v1.2.1