#29392 [Opn->Csd]: com_method_get() appears to not handle non-existant method properly
| From: | wez@php.net | Date: | Tue, 27 Jul 2004 02:02:09 +0000 |
| Subject: | #29392 [Opn->Csd]: com_method_get() appears to not handle non-existant method properly | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-63603@lists.php.net to get a copy of this message | ||
ID: 29392
Updated by: wez@php.net
Reported By: msisolak at yahoo dot com
-Status: Open
+Status: Closed
Bug Type: COM related
Operating System: Windows 2000 Professional
PHP Version: 5.0.0
New Comment:
Fixed in HEAD; thanks for pointing out the error :-)
Actual Fix was:
http://cvs.php.net/diff.php/php-src/ext/com_dotnet/com_handlers.c?r1=1.22&r2=1.23&ty=u
Previous Comments:
------------------------------------------------------------------------
[2004-07-26 18:56:16] msisolak at yahoo dot com
Description:
------------
Trying to echo a COM object results in crash.
When zend_call_function() is called to lookup "__tostring" in a COM
object, it calls into com_method_get(). In turn this calls
ITypeComp_Bind to lookup the method. If the method is not found the
result is DESCKIND_NONE, but the switch(kind) statement isn't testing
for this. As a result com_method_get() returns a
zend_internal_function with an invalid handler. The handler is called
and PHP crashes.
I came up with this possible code as the response to a DESCKIND_NONE:
case DESCKIND_NONE:
ITypeComp_Release(comp);
efree(olename);
return NULL;
but I'm not too confident about it. It does stop the crash in my test
case, but there may be a better solution.
Reproduce code:
---------------
$c = new COM("ADODB.Connection");
echo $c;
Expected result:
----------------
Either error on trying to echo object with no __toString() method, or
nothing.
Actual result:
--------------
The instruction at "0x00e5c208" referenced memory at "0x0000000". The
memory could not be "written".
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=29392&edit=1