File tree Expand file tree Collapse file tree 2 files changed +28
-1
lines changed Expand file tree Collapse file tree 2 files changed +28
-1
lines changed Original file line number Diff line number Diff line change @@ -196,6 +196,7 @@ PHP_FUNCTION(com_dotnet_create_instance)
196
196
int ret = FAILURE ;
197
197
char * where = "" ;
198
198
IUnknown * unk = NULL ;
199
+ zend_long cp = CP_ACP ;
199
200
200
201
php_com_initialize ();
201
202
stuff = (struct dotnet_runtime_stuff * )COMG (dotnet_runtime_stuff );
@@ -245,11 +246,17 @@ PHP_FUNCTION(com_dotnet_create_instance)
245
246
if (FAILURE == zend_parse_parameters (ZEND_NUM_ARGS (), "ss|l" ,
246
247
& assembly_name , & assembly_name_len ,
247
248
& datatype_name , & datatype_name_len ,
248
- & obj -> code_page )) {
249
+ & cp )) {
249
250
php_com_throw_exception (E_INVALIDARG , "Could not create .Net object - invalid arguments!" );
250
251
return ;
251
252
}
252
253
254
+ if (Z_L (0 ) > cp || ZEND_LONG_INT_OVFL (cp )) {
255
+ php_com_throw_exception (E_INVALIDARG , "Could not create .Net object - invalid codepage!" );
256
+ return ;
257
+ }
258
+ obj -> code_page = (int )cp ;
259
+
253
260
oletype = php_com_string_to_olestring (datatype_name , datatype_name_len , obj -> code_page );
254
261
oleassembly = php_com_string_to_olestring (assembly_name , assembly_name_len , obj -> code_page );
255
262
oletype_sys = SysAllocString (oletype );
Original file line number Diff line number Diff line change
1
+ --TEST--
2
+ Bug #73679 DOTNET read access violation using invalid codepage
3
+ --SKIPIF--
4
+ <?php # vim:ft=php
5
+ if (!extension_loaded ("com_dotnet " )) print "skip COM/.Net support not present " ; ?>
6
+ --FILE--
7
+ <?php
8
+
9
+ $ stack = new DOTNET ("mscorlib " , "System.Collections.Stack " , -2200000000 );
10
+ $ stack ->Push (".Net " );
11
+ $ stack ->Push ("Hello " );
12
+ echo $ stack ->Pop () . $ stack ->Pop ();
13
+
14
+ ?>
15
+ --EXPECTF--
16
+ Fatal error: Uncaught com_exception: Could not create .Net object - invalid codepage! in %sbug73679.php:%d
17
+ Stack trace:
18
+ #0 %sbug73679.php(%d): dotnet->dotnet('mscorlib', 'System.Collecti...', -2200000000)
19
+ #1 {main}
20
+ thrown in %sbug73679.php on line %d
You can’t perform that action at this time.
0 commit comments