diff options
| author | Nikita Popov <nikic@php.net> | 2016-09-27 19:47:48 +0200 |
|---|---|---|
| committer | Nikita Popov <nikic@php.net> | 2016-09-27 19:47:48 +0200 |
| commit | b7cbaa7f43d8a584e273e214209a4f7406a30029 (patch) | |
| tree | 0bc8f7fafde1b4e9a8489214bfc23ab44896596c | |
| parent | cb29c01ed6ff60bb693a0b943bc8993b45c462b4 (diff) | |
| download | php-git-b7cbaa7f43d8a584e273e214209a4f7406a30029.tar.gz | |
Fix bug #73181
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | Zend/tests/bug73181.phpt | 20 | ||||
| -rw-r--r-- | Zend/zend_hash.c | 8 |
3 files changed, 29 insertions, 3 deletions
@@ -2,7 +2,9 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2016 PHP 7.0.13 - +- Core: + . Fixed bug #73181 (parse_str() without a second argument leads to crash). + (Nikita) 13 Oct 2016 PHP 7.0.12 diff --git a/Zend/tests/bug73181.phpt b/Zend/tests/bug73181.phpt new file mode 100644 index 0000000000..2994e99b9f --- /dev/null +++ b/Zend/tests/bug73181.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #73181: parse_str() without a second argument leads to crash +--FILE-- +<?php + +function x() { + parse_str("1&x"); + var_dump(get_defined_vars()); +} + +x(); + +?> +--EXPECT-- +array(2) { + [1]=> + string(0) "" + ["x"]=> + string(0) "" +} diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c index efbc1e2ae4..aecdac6379 100644 --- a/Zend/zend_hash.c +++ b/Zend/zend_hash.c @@ -1447,13 +1447,17 @@ ZEND_API void ZEND_FASTCALL zend_symtable_clean(HashTable *ht) } else if (ht->nNumUsed == ht->nNumOfElements) { do { i_zval_ptr_dtor(&p->val ZEND_FILE_LINE_CC); - zend_string_release(p->key); + if (EXPECTED(p->key)) { + zend_string_release(p->key); + } } while (++p != end); } else { do { if (EXPECTED(Z_TYPE(p->val) != IS_UNDEF)) { i_zval_ptr_dtor(&p->val ZEND_FILE_LINE_CC); - zend_string_release(p->key); + if (EXPECTED(p->key)) { + zend_string_release(p->key); + } } } while (++p != end); } |