Skip to content

Commit dcd6a6f

Browse files
cmb69cmb69
committed
Merge branch 'PHP-7.2'
* PHP-7.2: Fix #76643: Segmentation fault when using `output_add_rewrite_var`
2 parents d775fe3 + a96ca13 commit dcd6a6f

File tree

4 files changed

+60
-44
lines changed

4 files changed

+60
-44
lines changed

‎NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ PHP NEWS
55
- Standard:
66
. Fixed bug #68553 (array_column: null values in $index_key become incrementing
77
keys in result). (Laruence)
8+
. Fixed bug #76643 (Segmentation fault when using `output_add_rewrite_var`).
9+
(cmb)
810

911
19 Jul 2018, PHP 7.3.0alpha4
1012

‎ext/standard/tests/general_functions/bug76643.phpt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
--TEST--
2+
Bug #76643 (Segmentation fault when using `output_add_rewrite_var`)
3+
--FILE--
4+
<?php
5+
$_SERVER = 'foo';
6+
output_add_rewrite_var('bar', 'baz');
7+
?>
8+
<form action="http://example.com/"></form>
9+
===DONE===
10+
--EXPECT--
11+
<form action="http://example.com/"></form>
12+
===DONE===

‎ext/standard/url_scanner_ex.c

Lines changed: 45 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,7 @@ static int check_http_host(char *target)
356356
char *colon;
357357

358358
if ((tmp = zend_hash_str_find(&EG(symbol_table), ZEND_STRL("_SERVER"))) &&
359+
Z_TYPE_P(tmp) == IS_ARRAY &&
359360
(host = zend_hash_str_find(Z_ARRVAL_P(tmp), ZEND_STRL("HTTP_HOST"))) &&
360361
Z_TYPE_P(host) == IS_STRING) {
361362
host_tmp = zend_string_init(Z_STRVAL_P(host), Z_STRLEN_P(host), 0);
@@ -521,7 +522,7 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
521522
state_plain:
522523
start = YYCURSOR;
523524

524-
#line 525 "ext/standard/url_scanner_ex.c"
525+
#line 526 "ext/standard/url_scanner_ex.c"
525526
{
526527
YYCTYPE yych;
527528
static const unsigned char yybm[] = {
@@ -571,22 +572,22 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
571572
if (yybm[0+yych] & 128) {
572573
goto yy2;
573574
}
574-
#line 528 "ext/standard/url_scanner_ex.re"
575+
#line 529 "ext/standard/url_scanner_ex.re"
575576
{ passthru(STD_ARGS); goto state_plain; }
576-
#line 577 "ext/standard/url_scanner_ex.c"
577+
#line 578 "ext/standard/url_scanner_ex.c"
577578
yy5:
578579
++YYCURSOR;
579-
#line 527 "ext/standard/url_scanner_ex.re"
580+
#line 528 "ext/standard/url_scanner_ex.re"
580581
{ passthru(STD_ARGS); STATE = STATE_TAG; goto state_tag; }
581-
#line 582 "ext/standard/url_scanner_ex.c"
582+
#line 583 "ext/standard/url_scanner_ex.c"
582583
}
583-
#line 529 "ext/standard/url_scanner_ex.re"
584+
#line 530 "ext/standard/url_scanner_ex.re"
584585

585586

586587
state_tag:
587588
start = YYCURSOR;
588589

589-
#line 590 "ext/standard/url_scanner_ex.c"
590+
#line 591 "ext/standard/url_scanner_ex.c"
590591
{
591592
YYCTYPE yych;
592593
static const unsigned char yybm[] = {
@@ -629,21 +630,21 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
629630
goto yy11;
630631
}
631632
++YYCURSOR;
632-
#line 535 "ext/standard/url_scanner_ex.re"
633+
#line 536 "ext/standard/url_scanner_ex.re"
633634
{ passthru(STD_ARGS); goto state_plain_begin; }
634-
#line 635 "ext/standard/url_scanner_ex.c"
635+
#line 636 "ext/standard/url_scanner_ex.c"
635636
yy11:
636637
++YYCURSOR;
637638
if (YYLIMIT <= YYCURSOR) YYFILL(1);
638639
yych = *YYCURSOR;
639640
if (yybm[0+yych] & 128) {
640641
goto yy11;
641642
}
642-
#line 534 "ext/standard/url_scanner_ex.re"
643+
#line 535 "ext/standard/url_scanner_ex.re"
643644
{ handle_tag(STD_ARGS); /* Sets STATE */; passthru(STD_ARGS); if (STATE == STATE_PLAIN) goto state_plain; else goto state_next_arg; }
644-
#line 645 "ext/standard/url_scanner_ex.c"
645+
#line 646 "ext/standard/url_scanner_ex.c"
645646
}
646-
#line 536 "ext/standard/url_scanner_ex.re"
647+
#line 537 "ext/standard/url_scanner_ex.re"
647648

648649

649650
state_next_arg_begin:
@@ -652,7 +653,7 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
652653
state_next_arg:
653654
start = YYCURSOR;
654655

655-
#line 656 "ext/standard/url_scanner_ex.c"
656+
#line 657 "ext/standard/url_scanner_ex.c"
656657
{
657658
YYCTYPE yych;
658659
static const unsigned char yybm[] = {
@@ -708,40 +709,40 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
708709
yy16:
709710
++YYCURSOR;
710711
yy17:
711-
#line 547 "ext/standard/url_scanner_ex.re"
712+
#line 548 "ext/standard/url_scanner_ex.re"
712713
{ passthru(STD_ARGS); goto state_plain_begin; }
713-
#line 714 "ext/standard/url_scanner_ex.c"
714+
#line 715 "ext/standard/url_scanner_ex.c"
714715
yy18:
715716
++YYCURSOR;
716717
if (YYLIMIT <= YYCURSOR) YYFILL(1);
717718
yych = *YYCURSOR;
718719
if (yybm[0+yych] & 128) {
719720
goto yy18;
720721
}
721-
#line 545 "ext/standard/url_scanner_ex.re"
722+
#line 546 "ext/standard/url_scanner_ex.re"
722723
{ passthru(STD_ARGS); goto state_next_arg; }
723-
#line 724 "ext/standard/url_scanner_ex.c"
724+
#line 725 "ext/standard/url_scanner_ex.c"
724725
yy21:
725726
yych = *++YYCURSOR;
726727
if (yych != '>') goto yy17;
727728
yy22:
728729
++YYCURSOR;
729-
#line 544 "ext/standard/url_scanner_ex.re"
730+
#line 545 "ext/standard/url_scanner_ex.re"
730731
{ passthru(STD_ARGS); handle_form(STD_ARGS); goto state_plain_begin; }
731-
#line 732 "ext/standard/url_scanner_ex.c"
732+
#line 733 "ext/standard/url_scanner_ex.c"
732733
yy24:
733734
++YYCURSOR;
734-
#line 546 "ext/standard/url_scanner_ex.re"
735+
#line 547 "ext/standard/url_scanner_ex.re"
735736
{ --YYCURSOR; STATE = STATE_ARG; goto state_arg; }
736-
#line 737 "ext/standard/url_scanner_ex.c"
737+
#line 738 "ext/standard/url_scanner_ex.c"
737738
}
738-
#line 548 "ext/standard/url_scanner_ex.re"
739+
#line 549 "ext/standard/url_scanner_ex.re"
739740

740741

741742
state_arg:
742743
start = YYCURSOR;
743744

744-
#line 745 "ext/standard/url_scanner_ex.c"
745+
#line 746 "ext/standard/url_scanner_ex.c"
745746
{
746747
YYCTYPE yych;
747748
static const unsigned char yybm[] = {
@@ -786,27 +787,27 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
786787
if (yych <= 'z') goto yy30;
787788
yy28:
788789
++YYCURSOR;
789-
#line 554 "ext/standard/url_scanner_ex.re"
790+
#line 555 "ext/standard/url_scanner_ex.re"
790791
{ passthru(STD_ARGS); STATE = STATE_NEXT_ARG; goto state_next_arg; }
791-
#line 792 "ext/standard/url_scanner_ex.c"
792+
#line 793 "ext/standard/url_scanner_ex.c"
792793
yy30:
793794
++YYCURSOR;
794795
if (YYLIMIT <= YYCURSOR) YYFILL(1);
795796
yych = *YYCURSOR;
796797
if (yybm[0+yych] & 128) {
797798
goto yy30;
798799
}
799-
#line 553 "ext/standard/url_scanner_ex.re"
800+
#line 554 "ext/standard/url_scanner_ex.re"
800801
{ passthru(STD_ARGS); handle_arg(STD_ARGS); STATE = STATE_BEFORE_VAL; goto state_before_val; }
801-
#line 802 "ext/standard/url_scanner_ex.c"
802+
#line 803 "ext/standard/url_scanner_ex.c"
802803
}
803-
#line 555 "ext/standard/url_scanner_ex.re"
804+
#line 556 "ext/standard/url_scanner_ex.re"
804805

805806

806807
state_before_val:
807808
start = YYCURSOR;
808809

809-
#line 810 "ext/standard/url_scanner_ex.c"
810+
#line 811 "ext/standard/url_scanner_ex.c"
810811
{
811812
YYCTYPE yych;
812813
static const unsigned char yybm[] = {
@@ -849,9 +850,9 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
849850
if (yych == '=') goto yy38;
850851
++YYCURSOR;
851852
yy36:
852-
#line 561 "ext/standard/url_scanner_ex.re"
853+
#line 562 "ext/standard/url_scanner_ex.re"
853854
{ --YYCURSOR; goto state_next_arg_begin; }
854-
#line 855 "ext/standard/url_scanner_ex.c"
855+
#line 856 "ext/standard/url_scanner_ex.c"
855856
yy37:
856857
yych = *(YYMARKER = ++YYCURSOR);
857858
if (yych == ' ') goto yy41;
@@ -863,9 +864,9 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
863864
if (yybm[0+yych] & 128) {
864865
goto yy38;
865866
}
866-
#line 560 "ext/standard/url_scanner_ex.re"
867+
#line 561 "ext/standard/url_scanner_ex.re"
867868
{ passthru(STD_ARGS); STATE = STATE_VAL; goto state_val; }
868-
#line 869 "ext/standard/url_scanner_ex.c"
869+
#line 870 "ext/standard/url_scanner_ex.c"
869870
yy41:
870871
++YYCURSOR;
871872
if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -875,14 +876,14 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
875876
YYCURSOR = YYMARKER;
876877
goto yy36;
877878
}
878-
#line 562 "ext/standard/url_scanner_ex.re"
879+
#line 563 "ext/standard/url_scanner_ex.re"
879880

880881

881882

882883
state_val:
883884
start = YYCURSOR;
884885

885-
#line 886 "ext/standard/url_scanner_ex.c"
886+
#line 887 "ext/standard/url_scanner_ex.c"
886887
{
887888
YYCTYPE yych;
888889
static const unsigned char yybm[] = {
@@ -935,15 +936,15 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
935936
if (yybm[0+yych] & 32) {
936937
goto yy46;
937938
}
938-
#line 570 "ext/standard/url_scanner_ex.re"
939+
#line 571 "ext/standard/url_scanner_ex.re"
939940
{ handle_val(STD_ARGS, 0, ' '); goto state_next_arg_begin; }
940-
#line 941 "ext/standard/url_scanner_ex.c"
941+
#line 942 "ext/standard/url_scanner_ex.c"
941942
yy49:
942943
++YYCURSOR;
943944
yy50:
944-
#line 571 "ext/standard/url_scanner_ex.re"
945+
#line 572 "ext/standard/url_scanner_ex.re"
945946
{ passthru(STD_ARGS); goto state_next_arg_begin; }
946-
#line 947 "ext/standard/url_scanner_ex.c"
947+
#line 948 "ext/standard/url_scanner_ex.c"
947948
yy51:
948949
yych = *(YYMARKER = ++YYCURSOR);
949950
if (yych == '>') goto yy50;
@@ -966,9 +967,9 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
966967
goto yy50;
967968
yy56:
968969
++YYCURSOR;
969-
#line 568 "ext/standard/url_scanner_ex.re"
970+
#line 569 "ext/standard/url_scanner_ex.re"
970971
{ handle_val(STD_ARGS, 1, '"'); goto state_next_arg_begin; }
971-
#line 972 "ext/standard/url_scanner_ex.c"
972+
#line 973 "ext/standard/url_scanner_ex.c"
972973
yy58:
973974
++YYCURSOR;
974975
if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -979,11 +980,11 @@ static inline void xx_mainloop(url_adapt_state_ex_t *ctx, const char *newdata, s
979980
}
980981
if (yych >= '(') goto yy55;
981982
++YYCURSOR;
982-
#line 569 "ext/standard/url_scanner_ex.re"
983+
#line 570 "ext/standard/url_scanner_ex.re"
983984
{ handle_val(STD_ARGS, 1, '\''); goto state_next_arg_begin; }
984-
#line 985 "ext/standard/url_scanner_ex.c"
985+
#line 986 "ext/standard/url_scanner_ex.c"
985986
}
986-
#line 572 "ext/standard/url_scanner_ex.re"
987+
#line 573 "ext/standard/url_scanner_ex.re"
987988

988989

989990
stop:

‎ext/standard/url_scanner_ex.re

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -359,6 +359,7 @@ static int check_http_host(char *target)
359359
char *colon;
360360

361361
if ((tmp = zend_hash_str_find(&EG(symbol_table), ZEND_STRL("_SERVER"))) &&
362+
Z_TYPE_P(tmp) == IS_ARRAY &&
362363
(host = zend_hash_str_find(Z_ARRVAL_P(tmp), ZEND_STRL("HTTP_HOST"))) &&
363364
Z_TYPE_P(host) == IS_STRING) {
364365
host_tmp = zend_string_init(Z_STRVAL_P(host), Z_STRLEN_P(host), 0);

0 commit comments

Comments
 (0)