com php-src: fix #66872, invalid argument crashes gmp_testbit : ext/gmp/gmp.c

Commit: af41914e15c3c67821ad5f9a0caf11f44b938e4b Author: Pierre Joye <pierre.php@gmail.com> Mon, 10 Mar 2014 12:06:40 +0100 Parents: cedc718f73fc6ea2f3164f31c6e8bd094ba0f917 Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=af41914e15c3c67821ad5f9a0caf11f44b938e4b Log: fix #66872, invalid argument crashes gmp_testbit Bugs: https://bugs.php.net/66872 Changed paths: M ext/gmp/gmp.c Diff: diff --git a/ext/gmp/gmp.c b/ext/gmp/gmp..c index 25e8203..134cc48 100644 --- a/ext/gmp/gmp.c +++ b/ext/gmp/gmp.c @@ -1511,25 +1511,23 @@ ZEND_FUNCTION(gmp_clrbit) Tests if bit is set in a */ ZEND_FUNCTION(gmp_testbit) { - zval **a_arg; + zval *a_arg; long index; - mpz_t *gmpnum_a; + mpz_ptr gmpnum_a; + gmp_temp_t temp_a; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Zl", &a_arg, &index) == FAILURE){ + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zl", &a_arg, &index) == FAILURE){ return; } - ZEND_FETCH_RESOURCE(gmpnum_a, mpz_t *, a_arg, -1, GMP_RESOURCE_NAME, le_gmp); - if (index < 0) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Index must be greater than or equal to zero"); RETURN_FALSE; } - if (mpz_tstbit(*gmpnum_a, index)) { - RETURN_TRUE; - } - RETURN_FALSE; + FETCH_GMP_ZVAL(gmpnum_a, a_arg, temp_a); + RETVAL_BOOL(mpz_tstbit(gmpnum_a, index)); + FREE_GMP_TEMP(temp_a); } /* }}} */