cvs: php-src(PHP_4_4) / NEWS /ext/xmlrpc xmlrpc-epi-php.c

tony2001 Tue Oct 4 07:19:56 2005 EDT Modified files: (Branch: PHP_4_4) /php-src NEWS /php-src/ext/xmlrpc xmlrpc-epi-php.c Log: MFB5.1: fix #32179 (xmlrpc_encode() segfaults with recursive references) http://cvs.php.net/diff.php/php-src/NEWS?r1=1.1247.2.920.2.44&r2=1.1247.2.920.2.45&ty=u Index: php-src/NEWS diff -u php-src/NEWS:1.1247.2.920.2.44 php-src/NEWS:1.1247.2.920.2.45 --- php-src/NEWS:1.1247.2.920.2.44 Thu Sep 29 12:31:46 2005 +++ php-src/NEWS Tue Oct 4 07:19:55 2005 @@ -43,6 +43,7 @@ - Fixed bug #33156 (cygwin version of setitimer doesn't accept ITIMER_PROF). (Nuno) - Fixed bug #32589 (possible crash inside imap_mail_compose() function). (Ilia) +- Fixed bug #32179 (xmlrpc_encode() segfaults with recursive references). (Tony) - Fixed bug #32160 (copying a file into itself leads to data loss). (Ilia) - Fixed bug #31158 (array_splice on $GLOBALS crashes). (Dmitry) - Fixed bug #29253 (array_diff with $GLOBALS argument fails). (Dmitry) http://cvs.php.net/diff.php/php-src/ext/xmlrpc/xmlrpc-epi-php.c?r1=1.24.2.4&r2=1.24.2.4.4.1&ty=u Index: php-src/ext/xmlrpc/xmlrpc-epi-php.c diff -u php-src/ext/xmlrpc/xmlrpc-epi-php.c:1.24.2.4 php-src/ext/xmlrpc/xmlrpc-epi-php.c:1.24.2.4.4.1 --- php-src/ext/xmlrpc/xmlrpc-epi-php.c:1.24.2.4 Thu Aug 28 16:01:32 2003 +++ php-src/ext/xmlrpc/xmlrpc-epi-php.c Tue Oct 4 07:19:56 2005 @@ -51,7 +51,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: xmlrpc-epi-php.c,v 1.24.2.4 2003/08/28 20:01:32 iliaa Exp $ */ +/* $Id: xmlrpc-epi-php.c,v 1.24.2.4.4.1 2005/10/04 11:19:56 tony2001 Exp $ */ /********************************************************************** * BUGS: * @@ -524,28 +524,41 @@ unsigned long num_index; zval** pIter; char* my_key; + HashTable *ht = NULL; + ht = HASH_OF(val); + if (ht && ht->nApplyCount > 1) { + php_error_docref(NULL TSRMLS_CC, E_ERROR, "XML-RPC doesn't support circular references"); + return NULL; + } + convert_to_array(val); - xReturn = XMLRPC_CreateVector(key, determine_vector_type(Z_ARRVAL_P(val))); zend_hash_internal_pointer_reset(Z_ARRVAL_P(val)); - while(1) { + while(zend_hash_get_current_data(Z_ARRVAL_P(val), (void**)&pIter) == SUCCESS) { int res = my_zend_hash_get_current_key(Z_ARRVAL_P(val), &my_key, &num_index); - if(res == HASH_KEY_IS_LONG) { - if(zend_hash_get_current_data(Z_ARRVAL_P(val), (void**)&pIter) == SUCCESS) { - XMLRPC_AddValueToVector(xReturn, PHP_to_XMLRPC_worker(0, *pIter, depth++)); - } - } - else if(res == HASH_KEY_NON_EXISTANT) { - break; + + switch (res) { + case HASH_KEY_NON_EXISTANT: + break; + case HASH_KEY_IS_STRING: + case HASH_KEY_IS_LONG: + ht = HASH_OF(*pIter); + if (ht) { + ht->nApplyCount++; + } + if (res == HASH_KEY_IS_LONG) { + XMLRPC_AddValueToVector(xReturn, PHP_to_XMLRPC_worker(0, *pIter, depth++)); + } + else { + XMLRPC_AddValueToVector(xReturn, PHP_to_XMLRPC_worker(my_key, *pIter, depth++)); + } + if (ht) { + ht->nApplyCount--; + } + break; } - else if(res == HASH_KEY_IS_STRING) { - if(zend_hash_get_current_data(Z_ARRVAL_P(val), (void**)&pIter) == SUCCESS) { - XMLRPC_AddValueToVector(xReturn, PHP_to_XMLRPC_worker(my_key, *pIter, depth++)); - } - } - zend_hash_move_forward(Z_ARRVAL_P(val)); } }