From 1bb92d52121cf2635df163911216bf2958db4d34 Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Wed, 17 Aug 2016 00:41:31 +0200 Subject: #72085: SEGV on unknown address zif_xml_parse We better make sure that the ZVALs we're accessing as arrays are indeed arrays. --- ext/xml/xml.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'ext/xml/xml.c') diff --git a/ext/xml/xml.c b/ext/xml/xml.c index 0850f0c605..9eba47be26 100644 --- a/ext/xml/xml.c +++ b/ext/xml/xml.c @@ -535,7 +535,8 @@ static zval *xml_call_handler(xml_parser *parser, zval *handler, zend_function * if (Z_TYPE_P(handler) == IS_STRING) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to call handler %s()", Z_STRVAL_P(handler)); - } else if (zend_hash_index_find(Z_ARRVAL_P(handler), 0, (void **) &obj) == SUCCESS && + } else if (Z_TYPE_P(handler) == IS_ARRAY && + zend_hash_index_find(Z_ARRVAL_P(handler), 0, (void **) &obj) == SUCCESS && zend_hash_index_find(Z_ARRVAL_P(handler), 1, (void **) &method) == SUCCESS && Z_TYPE_PP(obj) == IS_OBJECT && Z_TYPE_PP(method) == IS_STRING) { -- cgit v1.2.1