#29392 [Csd->Fbk]: com_method_get() appears to not handle non-existant method properly
| From: | wez@php.net | Date: | Tue, 27 Jul 2004 02:40:49 +0000 |
| Subject: | #29392 [Csd->Fbk]: com_method_get() appears to not handle non-existant method properly | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-63606@lists.php.net to get a copy of this message | ||
ID: 29392
Updated by: wez@php.net
Reported By: msisolak at yahoo dot com
-Status: Closed
+Status: Feedback
Bug Type: COM related
Operating System: Windows 2000 Professional
PHP Version: 5.0.0
New Comment:
Actually, this broke calling methods that are dynamically added at
runtime.
Would you mind trying to debug this a bit more?
It sounds like the crash is somewhere else.
Previous Comments:
------------------------------------------------------------------------
[2004-07-27 04:02:08] wez@php.net
Fixed in HEAD; thanks for pointing out the error :-)
Actual Fix was:
http://cvs.php.net/diff.php/php-src/ext/com_dotnet/com_handlers.c?r1=1.22&r2=1.23&ty=u
------------------------------------------------------------------------
[2004-07-26 18:56:16] msisolak at yahoo dot com
Description:
------------
Trying to echo a COM object results in crash.
When zend_call_function() is called to lookup "__tostring" in a COM
object, it calls into com_method_get(). In turn this calls
ITypeComp_Bind to lookup the method. If the method is not found the
result is DESCKIND_NONE, but the switch(kind) statement isn't testing
for this. As a result com_method_get() returns a
zend_internal_function with an invalid handler. The handler is called
and PHP crashes.
I came up with this possible code as the response to a DESCKIND_NONE:
case DESCKIND_NONE:
ITypeComp_Release(comp);
efree(olename);
return NULL;
but I'm not too confident about it. It does stop the crash in my test
case, but there may be a better solution.
Reproduce code:
---------------
$c = new COM("ADODB.Connection");
echo $c;
Expected result:
----------------
Either error on trying to echo object with no __toString() method, or
nothing.
Actual result:
--------------
The instruction at "0x00e5c208" referenced memory at "0x0000000". The
memory could not be "written".
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=29392&edit=1