dmitry Thu Jun 9 06:14:01 2005 EDT
Modified files: (Branch: PHP_5_0)
/php-src NEWS
/ZendEngine2 zend.c
Log:
Fixed bug #25922 (In error handler, modifying 5th arg (errcontext) may result
in seg fault)
http://cvs.php.net/diff.php/php-src/NEWS?r1=1.1760.2.429&r2=1.1760.2.430&ty=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.1760.2.429 php-src/NEWS:1.1760.2.430
--- php-src/NEWS:1.1760.2.429 Wed Jun 8 19:51:05 2005
+++ php-src/NEWS Thu Jun 9 06:13:57 2005
@@ -167,6 +167,8 @@
(Dmitry)
- Fixed bug #26456 (Wrong results from Reflection-API getDocComment() when
called via STDIN). (Dmitry)
+- Fixed bug #25922 (In error handler, modifying 5th arg (errcontext) may result
+ in seg fault). (Dmitry)
- Fixed bug #22836 (returning reference to uninitialized variable). (Dmitry)
31 Mar 2005, PHP 5.0.4
http://cvs.php.net/diff.php/ZendEngine2/zend.c?r1=1.287.2.9&r2=1.287.2.10&ty=u
Index: ZendEngine2/zend.c
diff -u ZendEngine2/zend.c:1.287.2.9 ZendEngine2/zend.c:1.287.2.10
--- ZendEngine2/zend.c:1.287.2.9 Fri Jun 3 11:36:48 2005
+++ ZendEngine2/zend.c Thu Jun 9 06:14:01 2005
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: zend.c,v 1.287.2.9 2005/06/03 15:36:48 dmitry Exp $ */
+/* $Id: zend.c,v 1.287.2.10 2005/06/09 10:14:01 dmitry Exp $ */
#include "zend.h"
#include "zend_extensions.h"
@@ -981,6 +981,9 @@
EG(user_error_handler) = NULL;
if (call_user_function_ex(CG(function_table), NULL,
orig_user_error_handler, &retval, 5, params, 1, NULL TSRMLS_CC)==SUCCESS) {
+ if (Z_TYPE_P(z_context) != IS_ARRAY ||
z_context->value.ht != EG(active_symbol_table)) {
+ zend_error(E_ERROR, "User error handler
must not modify error context");
+ }
if (retval) {
if (Z_TYPE_P(retval) == IS_BOOL &&
Z_LVAL_P(retval) == 0) {
zend_error_cb(type,
error_filename, error_lineno, format, args);
--
Zend Engine CVS Mailing List (http://cvs.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
|
