tony2001 Fri Aug 11 17:44:48 2006 UTC
Added files: (Branch: PHP_5_1)
/php-src/ext/xmlrpc/tests bug38431.phpt
Modified files:
/php-src NEWS
/php-src/ext/xmlrpc xmlrpc-epi-php.c
Log:
MFH: fix #38431 (xmlrpc_get_type() crashes PHP on objects)
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.565&r2=1.2027.2.566&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.565 php-src/NEWS:1.2027.2.566
--- php-src/NEWS:1.2027.2.565 Fri Aug 11 03:02:55 2006
+++ php-src/NEWS Fri Aug 11 17:44:47 2006
@@ -5,6 +5,7 @@
- Fixed overflow on 64bit systems in str_repeat() and wordwrap(). (Stefan E.)
- Disabled CURLOPT_FOLLOWLOCATION in curl when open_basedir or safe_mode are
enabled. (Stefan E., Ilia)
+- Fixed bug #38431 (xmlrpc_get_type() crashes PHP on objects). (Tony)
- Fixed bug #38322 (reading past array in sscanf() leads to arbitrary code
execution). (Tony)
- Fixed bug #38125 (undefined reference to spl_dual_it_free_storage). (Marcus)
http://cvs.php.net/viewvc.cgi/php-src/ext/xmlrpc/xmlrpc-epi-php.c?r1=1.39.2.5&r2=1.39.2.6&diff_format=u
Index: php-src/ext/xmlrpc/xmlrpc-epi-php.c
diff -u php-src/ext/xmlrpc/xmlrpc-epi-php.c:1.39.2.5
php-src/ext/xmlrpc/xmlrpc-epi-php.c:1.39.2.6
--- php-src/ext/xmlrpc/xmlrpc-epi-php.c:1.39.2.5 Wed Apr 12 15:13:56 2006
+++ php-src/ext/xmlrpc/xmlrpc-epi-php.c Fri Aug 11 17:44:48 2006
@@ -51,7 +51,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: xmlrpc-epi-php.c,v 1.39.2.5 2006/04/12 15:13:56 tony2001 Exp $ */
+/* $Id: xmlrpc-epi-php.c,v 1.39.2.6 2006/08/11 17:44:48 tony2001 Exp $ */
/**********************************************************************
* BUGS: *
@@ -1468,7 +1468,7 @@
type = get_zval_xmlrpc_type(*arg, 0);
if (type == xmlrpc_vector) {
- vtype = determine_vector_type(Z_ARRVAL_PP(arg));
+ vtype = determine_vector_type((Z_TYPE_PP(arg) == IS_OBJECT) ?
Z_OBJPROP_PP(arg) : Z_ARRVAL_PP(arg));
}
RETURN_STRING((char*) xmlrpc_type_as_str(type, vtype), 1);
http://cvs.php.net/viewvc.cgi/php-src/ext/xmlrpc/tests/bug38431.phpt?view=markup&rev=1.1
Index: php-src/ext/xmlrpc/tests/bug38431.phpt
+++ php-src/ext/xmlrpc/tests/bug38431.phpt
--TEST--
Bug #38431 (xmlrpc_get_type() crashes PHP on objects)
--SKIPIF--
<?php if (!extension_loaded("xmlrpc")) print "skip"; ?>
--FILE--
<?php
var_dump(xmlrpc_get_type(new stdclass));
var_dump(xmlrpc_get_type(array()));
$var = array(1,2,3);
var_dump(xmlrpc_get_type($var));
$var = array("test"=>1,2,3);
var_dump(xmlrpc_get_type($var));
$var = array("test"=>1,"test2"=>2);
var_dump(xmlrpc_get_type($var));
echo "Done\n";
?>
--EXPECTF--
string(5) "array"
string(5) "array"
string(5) "array"
string(5) "mixed"
string(6) "struct"
Done
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
