diff options
| author | Rob Richards <rrichards@php.net> | 2006-12-09 10:53:05 +0000 |
|---|---|---|
| committer | Rob Richards <rrichards@php.net> | 2006-12-09 10:53:05 +0000 |
| commit | fb2db6e6b1d3b0efad56082514b9a615fe112e11 (patch) | |
| tree | e019238324f31e4bcef0eb9b38379dcb529e31ce /ext/com_dotnet | |
| parent | 2dd22beedb0cef8e3e287df5841d7cd06e59ef74 (diff) | |
| download | php-git-fb2db6e6b1d3b0efad56082514b9a615fe112e11.tar.gz | |
MFB: fix heap corruption when adding/caching typelib (also fixes bug 39606)
add test
Diffstat (limited to 'ext/com_dotnet')
| -rw-r--r-- | ext/com_dotnet/com_typeinfo.c | 6 | ||||
| -rw-r--r-- | ext/com_dotnet/tests/bug39606.phpt | 22 |
2 files changed, 25 insertions, 3 deletions
diff --git a/ext/com_dotnet/com_typeinfo.c b/ext/com_dotnet/com_typeinfo.c index 004b6de73b..c4941e03e8 100644 --- a/ext/com_dotnet/com_typeinfo.c +++ b/ext/com_dotnet/com_typeinfo.c @@ -220,8 +220,8 @@ PHPAPI int php_com_import_typelib(ITypeLib *TL, int mode, int codepage TSRMLS_DC /* Type-library stuff */ void php_com_typelibrary_dtor(void *pDest) { - ITypeLib *Lib = (ITypeLib*)pDest; - ITypeLib_Release(Lib); + ITypeLib **Lib = (ITypeLib**)pDest; + ITypeLib_Release(*Lib); } PHPAPI ITypeLib *php_com_load_typelib_via_cache(char *search_string, @@ -249,7 +249,7 @@ PHPAPI ITypeLib *php_com_load_typelib_via_cache(char *search_string, if (TL) { if (SUCCESS == zend_ts_hash_update(&php_com_typelibraries, - search_string, l+1, (void*)TL, sizeof(ITypeLib*), NULL)) { + search_string, l+1, (void*)&TL, sizeof(ITypeLib*), NULL)) { /* add a reference for the hash table */ ITypeLib_AddRef(TL); } diff --git a/ext/com_dotnet/tests/bug39606.phpt b/ext/com_dotnet/tests/bug39606.phpt new file mode 100644 index 0000000000..4487c1d8cb --- /dev/null +++ b/ext/com_dotnet/tests/bug39606.phpt @@ -0,0 +1,22 @@ +--TEST-- +COM: Loading typelib corrupts memory +--SKIPIF-- +<?php # vim:ft=php +if (!extension_loaded("com_dotnet")) print "skip COM/.Net support not present"; ?> +--FILE-- +<?php // $Id$ +error_reporting(E_ALL); + +$arEnv = array_change_key_case($_SERVER, CASE_UPPER); + +$root = dirname($arEnv['COMSPEC']); +$typelib = $root.'\activeds.tlb'; + +var_dump(com_load_typelib($typelib)); +var_dump(com_load_typelib($typelib)); +?> +===DONE=== +--EXPECT-- +bool(true) +bool(true) +===DONE===
\ No newline at end of file |