mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-24 10:24:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Revert "Fixed bug Bug #70895 null ptr deref and segfault"

Browse Source 
This reverts commit 8eef11d317.
This commit is contained in:
Xinchen Hui 2015-11-12 14:34:00 +08:00
parent c245fd7d91
commit 2bed2152e6
2 changed files with 1 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
Zend/tests/bug70895.phpt
View File

@ -1,15 +0,0 @@
--TEST--
Bug #70895 null ptr deref and segfault with crafted calable
--FILE--
<?php
array_map("%n", 0);
array_map("%n %i", 0);
array_map("%n %i aoeu %f aoeu %p", 0);
?>
--EXPECTREGEX--
Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n' not found or invalid function name in .+
Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n %i' not found or invalid function name in .+
Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n %i aoeu %f aoeu %p' not found or invalid function name in .+bug70895.php on line \d+

23
Zend/zend_API.c
View File

@ -2989,28 +2989,7 @@ static int zend_is_callable_check_func(int check_flags, zval *callable, zend_fca
} else {
/* We already checked for plain function before. */
if (error && !(check_flags & IS_CALLABLE_CHECK_SILENT)) {
size_t callable_name_len = Z_STRLEN_P(callable), sanitized_callable_name_len = Z_STRLEN_P(callable), k = 0, n = 0;
char *callable_name = Z_STRVAL_P(callable), *sanitized_callable_name = emalloc(sizeof(char) * callable_name_len);
while (k < callable_name_len) {
sanitized_callable_name[n] = callable_name[k];
if ('%' == callable_name[k]) {
n++;
sanitized_callable_name[n] = '%';
}
k++;
n++;
if (n == sanitized_callable_name_len) {
sanitized_callable_name_len += callable_name_len - k;
sanitized_callable_name = erealloc(sanitized_callable_name, sanitized_callable_name_len);
}
}
sanitized_callable_name[n] = '\0';
zend_spprintf(error, 0, "function '%s' not found or invalid function name", sanitized_callable_name);
efree(sanitized_callable_name);
zend_spprintf(error, 0, "function '%s' not found or invalid function name", Z_STRVAL_P(callable));
}
return 0;
}