From a5e15f2e1c5bb5507269fa18174ea195e9c0c8d9 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Mon, 2 Jan 2006 22:19:37 +0000 Subject: Fixed possible crash in apache_getenv()/apache_setenv() on invalid parameters. --- sapi/apache2handler/php_functions.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) (limited to 'sapi/apache2handler/php_functions.c') diff --git a/sapi/apache2handler/php_functions.c b/sapi/apache2handler/php_functions.c index fc987ec531..2df54c5d45 100644 --- a/sapi/apache2handler/php_functions.c +++ b/sapi/apache2handler/php_functions.c @@ -264,10 +264,13 @@ PHP_FUNCTION(apache_setenv) ctx = SG(server_context); r = ctx->r; - if (arg_count == 3 && Z_STRVAL_PP(walk_to_top)) { - while(r->prev) { - r = r->prev; - } + if (arg_count == 3) { + convert_to_boolean_ex(walk_to_top); + if (Z_LVAL_PP(walk_to_top)) { + while(r->prev) { + r = r->prev; + } + } } convert_to_string_ex(variable); @@ -300,10 +303,13 @@ PHP_FUNCTION(apache_getenv) ctx = SG(server_context); r = ctx->r; - if (arg_count == 2 && Z_STRVAL_PP(walk_to_top)) { - while(r->prev) { - r = r->prev; - } + if (arg_count == 2) { + convert_to_boolean_ex(walk_to_top); + if (Z_LVAL_PP(walk_to_top)) { + while(r->prev) { + r = r->prev; + } + } } convert_to_string_ex(variable); -- cgit v1.2.1