cvs: php-src(PHP_5_1) / NEWS /sapi/apache2handler php_functions.c

iliaa Mon Jan 2 22:19:38 2006 UTC Modified files: (Branch: PHP_5_1) /php-src/sapi/apache2handler php_functions.c /php-src NEWS Log: Fixed possible crash in apache_getenv()/apache_setenv() on invalid parameters. http://cvs.php.net/viewcvs.cgi/php-src/sapi/apache2handler/php_functions.c?r1=1.18.2.4&r2=1.18.2.5&diff_format=u Index: php-src/sapi/apache2handler/php_functions.c diff -u php-src/sapi/apache2handler/php_functions.c:1.18.2.4 php-src/sapi/apache2handler/php_functions.c:1.18.2.5 --- php-src/sapi/apache2handler/php_functions.c:1.18.2.4 Mon Jan 2 22:10:38 2006 +++ php-src/sapi/apache2handler/php_functions.c Mon Jan 2 22:19:37 2006 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: php_functions.c,v 1.18.2.4 2006/01/02 22:10:38 sniper Exp $ */ +/* $Id: php_functions.c,v 1.18.2.5 2006/01/02 22:19:37 iliaa Exp $ */ #define ZEND_INCLUDE_FULL_WINDOWS_HEADERS @@ -264,10 +264,13 @@ ctx = SG(server_context); r = ctx->r; - if (arg_count == 3 && Z_STRVAL_PP(walk_to_top)) { - while(r->prev) { - r = r->prev; - } + if (arg_count == 3) { + convert_to_boolean_ex(walk_to_top); + if (Z_LVAL_PP(walk_to_top)) { + while(r->prev) { + r = r->prev; + } + } } convert_to_string_ex(variable); @@ -300,10 +303,13 @@ ctx = SG(server_context); r = ctx->r; - if (arg_count == 2 && Z_STRVAL_PP(walk_to_top)) { - while(r->prev) { - r = r->prev; - } + if (arg_count == 2) { + convert_to_boolean_ex(walk_to_top); + if (Z_LVAL_PP(walk_to_top)) { + while(r->prev) { + r = r->prev; + } + } } convert_to_string_ex(variable); http://cvs.php.net/viewcvs.cgi/php-src/NEWS?r1=1.2027.2.334&r2=1.2027.2.335&diff_format=u Index: php-src/NEWS diff -u php-src/NEWS:1.2027.2.334 php-src/NEWS:1.2027.2.335 --- php-src/NEWS:1.2027.2.334 Sun Jan 1 20:07:41 2006 +++ php-src/NEWS Mon Jan 2 22:19:37 2006 @@ -3,6 +3,8 @@ ?? Jan 2006, PHP 5.1.2RC2 - Added constants for libxslt and libexslt versions: LIBXSLT_VERSION, LIBXSLT_DOTTED_VERSION, LIBEXSLT_VERSION and LIBEXSLT_DOTTED_VERSION. (Pierre) +- Fixed possible crash in apache_getenv()/apache_setenv() on invalid parameters. + (Ilia) - Changed errors to warnings in imagecolormatch(). (Pierre) - Fixed segfault/leak in imagecolormatch(). (Pierre) - Fixed small leak in mysqli_stmt_fetch() when bound variable was empty string.