php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3' into PHP-8.4

Browse Source 
* PHP-8.3:
  Fix out of bound writes to SafeArray data
This commit is contained in:
Christoph M. Becker
2024-10-09 21:16:14 +02:00
parent f2fbb75f30 edb0af6f10
commit 42a2b046fe
3 changed files with 37 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
ext/com_dotnet/com_variant.c
View File

@@ -26,8 +26,7 @@
/* create an automation SafeArray from a PHP array.
* Only creates a single-dimensional array of variants.
* The keys of the PHP hash MUST be numeric. If the array
* is sparse, then the gaps will be filled with NULL variants */
* The keys of the PHP hash MUST be numeric. */
static void safe_array_from_zval(VARIANT *v, zval *z, int codepage)
{
SAFEARRAY *sa = NULL;
@@ -71,7 +70,9 @@ static void safe_array_from_zval(VARIANT *v, zval *z, int codepage)
break;
}
zend_hash_get_current_key_ex(Z_ARRVAL_P(z), &strindex, &intindex, &pos);
php_com_variant_from_zval(&va[intindex], item, codepage);
if (intindex < bound.cElements) {
php_com_variant_from_zval(&va[intindex], item, codepage);
}
}
/* Unlock it and stuff it into our variant */

30
ext/com_dotnet/tests/variant_variation.phpt Normal file
View File

@@ -0,0 +1,30 @@
--TEST--
Testing variant arrays
--EXTENSIONS--
com_dotnet
--FILE--
<?php
$arrays = [
"order" => [2 => 1, 1 => 2, 0 => 3],
"off" => [2 => 1, 1 => 2, 3],
"negative" => [-1 => 42],
];
foreach ($arrays as $desc => $array) {
echo "-- $desc --\n";
$v = new variant($array);
foreach ($v as $val) {
var_dump($val);
}
}
?>
--EXPECTF--
-- order --
int(3)
int(2)
int(1)
-- off --
NULL
int(2)
int(1)
-- negative --
%ANULL