svn: /php/php-src/branches/PHP_5_2/ext/standard/ array.c

dmitry Fri, 14 Aug 2009 06:18:47 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=287274 Log: Fixed crash in usort() and uasort() in case user comparison function modifyes the array. Changed paths: U php/php-src/branches/PHP_5_2/ext/standard/array.c Modified: php/php-src/branches/PHP_5_2/ext/standard/array.c =================================================================== --- php/php-src/branches/PHP_5_2/ext/standard/array.c 2009-08-14 03:59:18 UTC (rev 287273) +++ php/php-src/branches/PHP_5_2/ext/standard/array.c 2009-08-14 06:18:47 UTC (rev 287274) @@ -657,6 +657,7 @@ PHP_FUNCTION(usort) { zval **array; + int refcount; HashTable *target_hash; PHP_ARRAY_CMP_FUNC_VARS; @@ -678,12 +679,31 @@ PHP_ARRAY_CMP_FUNC_CHECK(BG(user_compare_func_name)) BG(user_compare_fci_cache).initialized = 0; + /* Clear the is_ref flag, so the attemts to modify the array in user + * comaprison function will create a copy of array and won't affect the + * original array. The fact of modification is detected using refcount + * comparison. The result of sorting in such case is undefined and the + * function returns FALSE. + */ + (*array)->is_ref = 0; + refcount = (*array)->refcount; + if (zend_hash_sort(target_hash, zend_qsort, array_user_compare, 1 TSRMLS_CC) == FAILURE) { - PHP_ARRAY_CMP_FUNC_RESTORE(); - RETURN_FALSE; + RETVAL_FALSE; + } else { + if (refcount > (*array)->refcount) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Array was modified by the user comparison function"); + RETVAL_FALSE; + } else { + RETVAL_TRUE; + } } + + if ((*array)->refcount > 1) { + (*array)->is_ref = 1; + } + PHP_ARRAY_CMP_FUNC_RESTORE(); - RETURN_TRUE; } /* }}} */ @@ -692,6 +712,7 @@ PHP_FUNCTION(uasort) { zval **array; + int refcount; HashTable *target_hash; PHP_ARRAY_CMP_FUNC_VARS; @@ -711,13 +732,31 @@ PHP_ARRAY_CMP_FUNC_CHECK(BG(user_compare_func_name)) BG(user_compare_fci_cache).initialized = 0; + /* Clear the is_ref flag, so the attemts to modify the array in user + * comaprison function will create a copy of array and won't affect the + * original array. The fact of modification is detected using refcount + * comparison. The result of sorting in such case is undefined and the + * function returns FALSE. + */ + (*array)->is_ref = 0; + refcount = (*array)->refcount; + if (zend_hash_sort(target_hash, zend_qsort, array_user_compare, 0 TSRMLS_CC) == FAILURE) { - PHP_ARRAY_CMP_FUNC_RESTORE(); - RETURN_FALSE; + RETVAL_FALSE; + } else { + if (refcount > (*array)->refcount) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Array was modified by the user comparison function"); + RETVAL_FALSE; + } else { + RETVAL_TRUE; + } } + + if ((*array)->refcount > 1) { + (*array)->is_ref = 1; + } + PHP_ARRAY_CMP_FUNC_RESTORE(); - - RETURN_TRUE; } /* }}} */