Skip to content

Commit a81eae5

Browse files
tony2001tony2001
committed
MFH: fix segfault/leak, add test
1 parent 9f5de3b commit a81eae5

File tree

2 files changed

+86
-13
lines changed

2 files changed

+86
-13
lines changed

‎ext/mbstring/php_mbregex.c

Lines changed: 7 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -518,7 +518,7 @@ PHP_FUNCTION(mb_regex_encoding)
518518
static void _php_mb_regex_ereg_exec(INTERNAL_FUNCTION_PARAMETERS, int icase)
519519
{
520520
zval tmp;
521-
zval *arg_pattern, *array;
521+
zval **arg_pattern, *array;
522522
char *string;
523523
int string_len;
524524
php_mb_regex_t *re;
@@ -529,7 +529,7 @@ static void _php_mb_regex_ereg_exec(INTERNAL_FUNCTION_PARAMETERS, int icase)
529529

530530
array = NULL;
531531

532-
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zs|z", &arg_pattern, &string, &string_len, &array) == FAILURE) {
532+
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Zs|z", &arg_pattern, &string, &string_len, &array) == FAILURE) {
533533
RETURN_FALSE;
534534
}
535535

@@ -539,18 +539,15 @@ static void _php_mb_regex_ereg_exec(INTERNAL_FUNCTION_PARAMETERS, int icase)
539539
}
540540

541541
/* compile the regular expression from the supplied regex */
542-
if (Z_TYPE_P(arg_pattern) != IS_STRING) {
542+
if (Z_TYPE_PP(arg_pattern) != IS_STRING) {
543543
/* we convert numbers to integers and treat them as a string */
544-
tmp = *arg_pattern;
545-
zval_copy_ctor(&tmp);
546-
if (Z_TYPE_P(&tmp) == IS_DOUBLE) {
547-
convert_to_long(&tmp); /* get rid of decimal places */
544+
if (Z_TYPE_PP(arg_pattern) == IS_DOUBLE) {
545+
convert_to_long_ex(arg_pattern); /* get rid of decimal places */
548546
}
549-
convert_to_string(&tmp);
550-
arg_pattern = &tmp;
547+
convert_to_string_ex(arg_pattern);
551548
/* don't bother doing an extended regex with just a number */
552549
}
553-
re = php_mbregex_compile_pattern(Z_STRVAL_P(arg_pattern), Z_STRLEN_P(arg_pattern), options, MBSTRG(current_mbctype), MBSTRG(regex_default_syntax) TSRMLS_CC);
550+
re = php_mbregex_compile_pattern(Z_STRVAL_PP(arg_pattern), Z_STRLEN_PP(arg_pattern), options, MBSTRG(current_mbctype), MBSTRG(regex_default_syntax) TSRMLS_CC);
554551
if (re == NULL) {
555552
RETVAL_FALSE;
556553
goto out;
@@ -590,9 +587,6 @@ static void _php_mb_regex_ereg_exec(INTERNAL_FUNCTION_PARAMETERS, int icase)
590587
if (regs != NULL) {
591588
onig_region_free(regs, 1);
592589
}
593-
if (arg_pattern == &tmp) {
594-
zval_dtor(&tmp);
595-
}
596590
}
597591
/* }}} */
598592

‎ext/mbstring/tests/mb_ereg1.phpt

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
--TEST--
2+
mb_ereg() and invalid arguments
3+
--SKIPIF--
4+
<?php if (!function_exists("mb_ereg")) print "skip"; ?>
5+
--FILE--
6+
<?php
7+
8+
$a = array(
9+
array(1,2,3),
10+
array("", "", ""),
11+
array(array(), 1, ""),
12+
array(1, array(), ""),
13+
array(1, "", array()),
14+
);
15+
16+
foreach ($a as $args) {
17+
var_dump(mb_ereg($args[0], $args[1], $args[2]));
18+
var_dump($args);
19+
}
20+
21+
echo "Done\n";
22+
?>
23+
--EXPECTF--
24+
bool(false)
25+
array(3) {
26+
[0]=>
27+
int(1)
28+
[1]=>
29+
int(2)
30+
[2]=>
31+
int(3)
32+
}
33+
int(1)
34+
array(3) {
35+
[0]=>
36+
string(0) ""
37+
[1]=>
38+
string(0) ""
39+
[2]=>
40+
array(1) {
41+
[0]=>
42+
bool(false)
43+
}
44+
}
45+
46+
Notice: Array to string conversion in %s on line %d
47+
bool(false)
48+
array(3) {
49+
[0]=>
50+
array(0) {
51+
}
52+
[1]=>
53+
int(1)
54+
[2]=>
55+
string(0) ""
56+
}
57+
58+
Warning: mb_ereg() expects parameter 2 to be string, array given in %s on line %d
59+
bool(false)
60+
array(3) {
61+
[0]=>
62+
int(1)
63+
[1]=>
64+
array(0) {
65+
}
66+
[2]=>
67+
string(0) ""
68+
}
69+
bool(false)
70+
array(3) {
71+
[0]=>
72+
int(1)
73+
[1]=>
74+
string(0) ""
75+
[2]=>
76+
array(0) {
77+
}
78+
}
79+
Done

0 commit comments

Comments
 (0)