diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2006-01-02 22:22:07 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2006-01-02 22:22:07 +0000 |
| commit | aca8fb1ca54f87875c6324ebd8891c9bfc83e125 (patch) | |
| tree | 2ff53721f2682b58883cc2cdd6bde782e88ee0ec /sapi/apache2handler/php_functions.c | |
| parent | 09e2c59133f4a72f062e02d81ad04b93a435f36b (diff) | |
| download | php-git-aca8fb1ca54f87875c6324ebd8891c9bfc83e125.tar.gz | |
MFH: Fixed possible crash in apache_getenv()/apache_setenv() on invalid
parameters.
Diffstat (limited to 'sapi/apache2handler/php_functions.c')
| -rw-r--r-- | sapi/apache2handler/php_functions.c | 22 |
1 files changed, 14 insertions, 8 deletions
diff --git a/sapi/apache2handler/php_functions.c b/sapi/apache2handler/php_functions.c index 871b1992cc..88e697932b 100644 --- a/sapi/apache2handler/php_functions.c +++ b/sapi/apache2handler/php_functions.c @@ -263,10 +263,13 @@ PHP_FUNCTION(apache_setenv) ctx = SG(server_context); r = ctx->r; - if (arg_count == 3 && Z_STRVAL_PP(walk_to_top)) { - while(r->prev) { - r = r->prev; - } + if (arg_count == 3) { + convert_to_boolean_ex(walk_to_top); + if (Z_LVAL_PP(walk_to_top)) { + while(r->prev) { + r = r->prev; + } + } } convert_to_string_ex(variable); @@ -299,10 +302,13 @@ PHP_FUNCTION(apache_getenv) ctx = SG(server_context); r = ctx->r; - if (arg_count == 2 && Z_STRVAL_PP(walk_to_top)) { - while(r->prev) { - r = r->prev; - } + if (arg_count == 2) { + convert_to_boolean_ex(walk_to_top); + if (Z_LVAL_PP(walk_to_top)) { + while(r->prev) { + r = r->prev; + } + } } convert_to_string_ex(variable); |