diff options
| author | Stanislav Malyshev <stas@php.net> | 2020-02-15 20:52:19 -0800 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-02-18 09:12:51 +0100 |
| commit | 08b47a3d0fcd16a4a8f351d5ee60bfa64e71b39f (patch) | |
| tree | 1a61cf45f063150fca60da0986d46bc3f63ad103 /ext/session/session.c | |
| parent | 2589f5bd83ff644d8345bb9c684fc4338435a3a3 (diff) | |
| download | php-git-08b47a3d0fcd16a4a8f351d5ee60bfa64e71b39f.tar.gz | |
Fix bug #79221 - Null Pointer Dereference in PHP Session Upload Progress
(cherry picked from commit 409965fe1cfa013abd377a5b567e2d19aac163e8)
Diffstat (limited to 'ext/session/session.c')
| -rw-r--r-- | ext/session/session.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/ext/session/session.c b/ext/session/session.c index d0779294ec..078b3f0b3c 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -3308,10 +3308,12 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo if (PS(rfc1867_cleanup)) { php_session_rfc1867_cleanup(progress); } else { - SEPARATE_ARRAY(&progress->data); - add_assoc_bool_ex(&progress->data, "done", sizeof("done") - 1, 1); - Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed; - php_session_rfc1867_update(progress, 1); + if (!Z_ISUNDEF(progress->data)) { + SEPARATE_ARRAY(&progress->data); + add_assoc_bool_ex(&progress->data, "done", sizeof("done") - 1, 1); + Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed; + php_session_rfc1867_update(progress, 1); + } } php_rshutdown_session_globals(); } |