Skip to content

Commit a96ca13

Browse files
cmb69cmb69
committed
Merge branch 'PHP-7.1' into PHP-7.2
* PHP-7.1: Fix #76643: Segmentation fault when using `output_add_rewrite_var`
2 parents 033dac7 + 40bd84d commit a96ca13

File tree

4 files changed

+60
-44
lines changed

4 files changed

+60
-44
lines changed

‎NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ PHP NEWS
1717
. Fixed bug #73817 (Incorrect entries in get_html_translation_table). (cmb)
1818
. Fixed bug #68553 (array_column: null values in $index_key become incrementing
1919
keys in result). (Laruence)
20+
. Fixed bug #76643 (Segmentation fault when using `output_add_rewrite_var`).
21+
(cmb)
2022

2123
- Zip:
2224
. Fixed bug #76524 (ZipArchive memory leak (OVERWRITE flag and empty archive)).

‎ext/standard/tests/general_functions/bug76643.phpt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
--TEST--
2+
Bug #76643 (Segmentation fault when using `output_add_rewrite_var`)
3+
--FILE--
4+
<?php
5+
$_SERVER = 'foo';
6+
output_add_rewrite_var('bar', 'baz');
7+
?>
8+
<form action="http://example.com/"></form>
9+
===DONE===
10+
--EXPECT--
11+
<form action="http://example.com/"></form>
12+
===DONE===

‎ext/standard/url_scanner_ex.c

Lines changed: 45 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -352,6 +352,7 @@ static int check_http_host(char *target)
352352
char *colon;
353353

354354
if ((tmp = zend_hash_str_find(&EG(symbol_table), ZEND_STRL("_SERVER"))) &&
355+
Z_TYPE_P(tmp) == IS_ARRAY &&
355356
(host = zend_hash_str_find(Z_ARRVAL_P(tmp), ZEND_STRL("HTTP_HOST"))) &&
356357
Z_TYPE_P(host) == IS_STRING) {
357358
host_tmp = zend_string_init(Z_STRVAL_P(host), Z_STRLEN_P(host), 0);
@@ -519,7 +520,7 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
519520
state_plain:
520521
start = YYCURSOR;
521522

522-
#line 523 "ext/standard/url_scanner_ex.c"
523+
#line 524 "ext/standard/url_scanner_ex.c"
523524
{
524525
YYCTYPE yych;
525526
static const unsigned char yybm[] = {
@@ -569,22 +570,22 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
569570
if (yybm[0+yych] & 128) {
570571
goto yy2;
571572
}
572-
#line 526 "ext/standard/url_scanner_ex.re"
573+
#line 527 "ext/standard/url_scanner_ex.re"
573574
{ passthru(STD_ARGS); goto state_plain; }
574-
#line 575 "ext/standard/url_scanner_ex.c"
575+
#line 576 "ext/standard/url_scanner_ex.c"
575576
yy5:
576577
++YYCURSOR;
577-
#line 525 "ext/standard/url_scanner_ex.re"
578+
#line 526 "ext/standard/url_scanner_ex.re"
578579
{ passthru(STD_ARGS); STATE = STATE_TAG; goto state_tag; }
579-
#line 580 "ext/standard/url_scanner_ex.c"
580+
#line 581 "ext/standard/url_scanner_ex.c"
580581
}
581-
#line 527 "ext/standard/url_scanner_ex.re"
582+
#line 528 "ext/standard/url_scanner_ex.re"
582583

583584

584585
state_tag:
585586
start = YYCURSOR;
586587

587-
#line 588 "ext/standard/url_scanner_ex.c"
588+
#line 589 "ext/standard/url_scanner_ex.c"
588589
{
589590
YYCTYPE yych;
590591
static const unsigned char yybm[] = {
@@ -627,21 +628,21 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
627628
goto yy11;
628629
}
629630
++YYCURSOR;
630-
#line 533 "ext/standard/url_scanner_ex.re"
631+
#line 534 "ext/standard/url_scanner_ex.re"
631632
{ passthru(STD_ARGS); goto state_plain_begin; }
632-
#line 633 "ext/standard/url_scanner_ex.c"
633+
#line 634 "ext/standard/url_scanner_ex.c"
633634
yy11:
634635
++YYCURSOR;
635636
if (YYLIMIT <= YYCURSOR) YYFILL(1);
636637
yych = *YYCURSOR;
637638
if (yybm[0+yych] & 128) {
638639
goto yy11;
639640
}
640-
#line 532 "ext/standard/url_scanner_ex.re"
641+
#line 533 "ext/standard/url_scanner_ex.re"
641642
{ handle_tag(STD_ARGS); /* Sets STATE */; passthru(STD_ARGS); if (STATE == STATE_PLAIN) goto state_plain; else goto state_next_arg; }
642-
#line 643 "ext/standard/url_scanner_ex.c"
643+
#line 644 "ext/standard/url_scanner_ex.c"
643644
}
644-
#line 534 "ext/standard/url_scanner_ex.re"
645+
#line 535 "ext/standard/url_scanner_ex.re"
645646

646647

647648
state_next_arg_begin:
@@ -650,7 +651,7 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
650651
state_next_arg:
651652
start = YYCURSOR;
652653

653-
#line 654 "ext/standard/url_scanner_ex.c"
654+
#line 655 "ext/standard/url_scanner_ex.c"
654655
{
655656
YYCTYPE yych;
656657
static const unsigned char yybm[] = {
@@ -706,40 +707,40 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
706707
yy16:
707708
++YYCURSOR;
708709
yy17:
709-
#line 545 "ext/standard/url_scanner_ex.re"
710+
#line 546 "ext/standard/url_scanner_ex.re"
710711
{ passthru(STD_ARGS); goto state_plain_begin; }
711-
#line 712 "ext/standard/url_scanner_ex.c"
712+
#line 713 "ext/standard/url_scanner_ex.c"
712713
yy18:
713714
++YYCURSOR;
714715
if (YYLIMIT <= YYCURSOR) YYFILL(1);
715716
yych = *YYCURSOR;
716717
if (yybm[0+yych] & 128) {
717718
goto yy18;
718719
}
719-
#line 543 "ext/standard/url_scanner_ex.re"
720+
#line 544 "ext/standard/url_scanner_ex.re"
720721
{ passthru(STD_ARGS); goto state_next_arg; }
721-
#line 722 "ext/standard/url_scanner_ex.c"
722+
#line 723 "ext/standard/url_scanner_ex.c"
722723
yy21:
723724
yych = *++YYCURSOR;
724725
if (yych != '>') goto yy17;
725726
yy22:
726727
++YYCURSOR;
727-
#line 542 "ext/standard/url_scanner_ex.re"
728+
#line 543 "ext/standard/url_scanner_ex.re"
728729
{ passthru(STD_ARGS); handle_form(STD_ARGS); goto state_plain_begin; }
729-
#line 730 "ext/standard/url_scanner_ex.c"
730+
#line 731 "ext/standard/url_scanner_ex.c"
730731
yy24:
731732
++YYCURSOR;
732-
#line 544 "ext/standard/url_scanner_ex.re"
733+
#line 545 "ext/standard/url_scanner_ex.re"
733734
{ --YYCURSOR; STATE = STATE_ARG; goto state_arg; }
734-
#line 735 "ext/standard/url_scanner_ex.c"
735+
#line 736 "ext/standard/url_scanner_ex.c"
735736
}
736-
#line 546 "ext/standard/url_scanner_ex.re"
737+
#line 547 "ext/standard/url_scanner_ex.re"
737738

738739

739740
state_arg:
740741
start = YYCURSOR;
741742

742-
#line 743 "ext/standard/url_scanner_ex.c"
743+
#line 744 "ext/standard/url_scanner_ex.c"
743744
{
744745
YYCTYPE yych;
745746
static const unsigned char yybm[] = {
@@ -784,27 +785,27 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
784785
if (yych <= 'z') goto yy30;
785786
yy28:
786787
++YYCURSOR;
787-
#line 552 "ext/standard/url_scanner_ex.re"
788+
#line 553 "ext/standard/url_scanner_ex.re"
788789
{ passthru(STD_ARGS); STATE = STATE_NEXT_ARG; goto state_next_arg; }
789-
#line 790 "ext/standard/url_scanner_ex.c"
790+
#line 791 "ext/standard/url_scanner_ex.c"
790791
yy30:
791792
++YYCURSOR;
792793
if (YYLIMIT <= YYCURSOR) YYFILL(1);
793794
yych = *YYCURSOR;
794795
if (yybm[0+yych] & 128) {
795796
goto yy30;
796797
}
797-
#line 551 "ext/standard/url_scanner_ex.re"
798+
#line 552 "ext/standard/url_scanner_ex.re"
798799
{ passthru(STD_ARGS); handle_arg(STD_ARGS); STATE = STATE_BEFORE_VAL; goto state_before_val; }
799-
#line 800 "ext/standard/url_scanner_ex.c"
800+
#line 801 "ext/standard/url_scanner_ex.c"
800801
}
801-
#line 553 "ext/standard/url_scanner_ex.re"
802+
#line 554 "ext/standard/url_scanner_ex.re"
802803

803804

804805
state_before_val:
805806
start = YYCURSOR;
806807

807-
#line 808 "ext/standard/url_scanner_ex.c"
808+
#line 809 "ext/standard/url_scanner_ex.c"
808809
{
809810
YYCTYPE yych;
810811
static const unsigned char yybm[] = {
@@ -847,9 +848,9 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
847848
if (yych == '=') goto yy38;
848849
++YYCURSOR;
849850
yy36:
850-
#line 559 "ext/standard/url_scanner_ex.re"
851+
#line 560 "ext/standard/url_scanner_ex.re"
851852
{ --YYCURSOR; goto state_next_arg_begin; }
852-
#line 853 "ext/standard/url_scanner_ex.c"
853+
#line 854 "ext/standard/url_scanner_ex.c"
853854
yy37:
854855
yych = *(YYMARKER = ++YYCURSOR);
855856
if (yych == ' ') goto yy41;
@@ -861,9 +862,9 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
861862
if (yybm[0+yych] & 128) {
862863
goto yy38;
863864
}
864-
#line 558 "ext/standard/url_scanner_ex.re"
865+
#line 559 "ext/standard/url_scanner_ex.re"
865866
{ passthru(STD_ARGS); STATE = STATE_VAL; goto state_val; }
866-
#line 867 "ext/standard/url_scanner_ex.c"
867+
#line 868 "ext/standard/url_scanner_ex.c"
867868
yy41:
868869
++YYCURSOR;
869870
if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -873,14 +874,14 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
873874
YYCURSOR = YYMARKER;
874875
goto yy36;
875876
}
876-
#line 560 "ext/standard/url_scanner_ex.re"
877+
#line 561 "ext/standard/url_scanner_ex.re"
877878

878879

879880

880881
state_val:
881882
start = YYCURSOR;
882883

883-
#line 884 "ext/standard/url_scanner_ex.c"
884+
#line 885 "ext/standard/url_scanner_ex.c"
884885
{
885886
YYCTYPE yych;
886887
static const unsigned char yybm[] = {
@@ -933,15 +934,15 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
933934
if (yybm[0+yych] & 32) {
934935
goto yy46;
935936
}
936-
#line 568 "ext/standard/url_scanner_ex.re"
937+
#line 569 "ext/standard/url_scanner_ex.re"
937938
{ handle_val(STD_ARGS, 0, ' '); goto state_next_arg_begin; }
938-
#line 939 "ext/standard/url_scanner_ex.c"
939+
#line 940 "ext/standard/url_scanner_ex.c"
939940
yy49:
940941
++YYCURSOR;
941942
yy50:
942-
#line 569 "ext/standard/url_scanner_ex.re"
943+
#line 570 "ext/standard/url_scanner_ex.re"
943944
{ passthru(STD_ARGS); goto state_next_arg_begin; }
944-
#line 945 "ext/standard/url_scanner_ex.c"
945+
#line 946 "ext/standard/url_scanner_ex.c"
945946
yy51:
946947
yych = *(YYMARKER = ++YYCURSOR);
947948
if (yych == '>') goto yy50;
@@ -964,9 +965,9 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
964965
goto yy50;
965966
yy56:
966967
++YYCURSOR;
967-
#line 566 "ext/standard/url_scanner_ex.re"
968+
#line 567 "ext/standard/url_scanner_ex.re"
968969
{ handle_val(STD_ARGS, 1, '"'); goto state_next_arg_begin; }
969-
#line 970 "ext/standard/url_scanner_ex.c"
970+
#line 971 "ext/standard/url_scanner_ex.c"
970971
yy58:
971972
++YYCURSOR;
972973
if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -977,11 +978,11 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
977978
}
978979
if (yych >= '(') goto yy55;
979980
++YYCURSOR;
980-
#line 567 "ext/standard/url_scanner_ex.re"
981+
#line 568 "ext/standard/url_scanner_ex.re"
981982
{ handle_val(STD_ARGS, 1, '\''); goto state_next_arg_begin; }
982-
#line 983 "ext/standard/url_scanner_ex.c"
983+
#line 984 "ext/standard/url_scanner_ex.c"
983984
}
984-
#line 570 "ext/standard/url_scanner_ex.re"
985+
#line 571 "ext/standard/url_scanner_ex.re"
985986

986987

987988
stop:

‎ext/standard/url_scanner_ex.re

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -355,6 +355,7 @@ static int check_http_host(char *target)
355355
char *colon;
356356

357357
if ((tmp = zend_hash_str_find(&EG(symbol_table), ZEND_STRL("_SERVER"))) &&
358+
Z_TYPE_P(tmp) == IS_ARRAY &&
358359
(host = zend_hash_str_find(Z_ARRVAL_P(tmp), ZEND_STRL("HTTP_HOST"))) &&
359360
Z_TYPE_P(host) == IS_STRING) {
360361
host_tmp = zend_string_init(Z_STRVAL_P(host), Z_STRLEN_P(host), 0);

0 commit comments

Comments
 (0)