diff --git a/NEWS b/NEWS index b7fa7a2f8a4..8d75b4a8f9a 100644 --- a/NEWS +++ b/NEWS @@ -7,6 +7,9 @@ PHP NEWS . Fixed bug #78656 (Parse errors classified as highest log-level). (Erik Lundin) +- COM: + . Fixed bug #78694 (Appending to a variant array causes segfault). (cmb) + - Date: . Fixed bug #70153 (\DateInterval incorrectly unserialized). (Maksim Iakunin) diff --git a/ext/com_dotnet/com_handlers.c b/ext/com_dotnet/com_handlers.c index 66218cfae82..42788185112 100644 --- a/ext/com_dotnet/com_handlers.c +++ b/ext/com_dotnet/com_handlers.c @@ -123,6 +123,11 @@ static void com_write_dimension(zval *object, zval *offset, zval *value) obj = CDNO_FETCH(object); + if (offset == NULL) { + php_com_throw_exception(DISP_E_BADINDEX, "appending to variants is not supported"); + return; + } + if (V_VT(&obj->v) == VT_DISPATCH) { ZVAL_COPY_VALUE(&args[0], offset); ZVAL_COPY_VALUE(&args[1], value); diff --git a/ext/com_dotnet/tests/bug78694.phpt b/ext/com_dotnet/tests/bug78694.phpt new file mode 100644 index 00000000000..adf0c828cac --- /dev/null +++ b/ext/com_dotnet/tests/bug78694.phpt @@ -0,0 +1,19 @@ +--TEST-- +Bug #78694 (Appending to a variant array causes segfault) +--SKIPIF-- + +--FILE-- +getMessage()); + } +} +?> +--EXPECT-- +string(38) "appending to variants is not supported" +string(38) "appending to variants is not supported"