- Throw an exception if an illegal string value is being used in ArrayObject::offsetSet()
authorMarcus Boerger <helly@php.net>
Mon, 3 Oct 2005 17:58:47 +0000 (17:58 +0000)
committerMarcus Boerger <helly@php.net>
Mon, 3 Oct 2005 17:58:47 +0000 (17:58 +0000)
ext/spl/spl_array.c
ext/spl/tests/array_018.phpt [new file with mode: 0755]

index adb83ccea4c97d1db54b5d3bcc6b49375f55a1b9..67ac81828527f4587af2c3801f307816541fe249 100755 (executable)
@@ -305,6 +305,10 @@ static void spl_array_write_dimension_ex(int check_inherited, zval *object, zval
        case IS_STRING:
        case IS_BINARY:
        case IS_UNICODE:
+               if (*(char*)Z_UNIVAL_P(offset) == '\0') {
+                       zend_throw_exception(U_CLASS_ENTRY(spl_ce_InvalidArgumentException), "An offset must not begin with \\0 or be empty", 0 TSRMLS_CC);
+                       return;
+               }
                value->refcount++;
                zend_u_symtable_update(spl_array_get_hash_table(intern, 0 TSRMLS_CC), Z_TYPE_P(offset), Z_UNIVAL_P(offset), Z_UNILEN_P(offset)+1, (void**)&value, sizeof(void*), NULL);
                return;
diff --git a/ext/spl/tests/array_018.phpt b/ext/spl/tests/array_018.phpt
new file mode 100755 (executable)
index 0000000..0cb8827
--- /dev/null
@@ -0,0 +1,50 @@
+--TEST--
+SPL: ArrayObject and \0
+--SKIPIF--
+<?php if (!extension_loaded("spl")) print "skip"; ?>
+--FILE--
+<?php
+
+try
+{
+       $foo = new ArrayObject();
+       $foo->offsetSet("\0", "Foo");
+}
+catch (Exception $e)
+{
+       var_dump($e->getMessage());
+}
+
+var_dump($foo);
+
+try
+{
+       $foo = new ArrayObject();
+       $data = explode("=", "=Foo");
+       $foo->offsetSet($data[0], $data[1]);
+}
+catch (Exception $e)
+{
+       var_dump($e->getMessage());
+}
+
+var_dump($foo);
+
+?>
+===DONE===
+--EXPECTF--
+string(44) "An offset must not begin with \0 or be empty"
+object(ArrayObject)#%d (0) {
+}
+string(44) "An offset must not begin with \0 or be empty"
+object(ArrayObject)#%d (0) {
+}
+===DONE===
+--UEXPECTF--
+unicode(44) "An offset must not begin with \0 or be empty"
+object(ArrayObject)#%d (0) {
+}
+unicode(44) "An offset must not begin with \0 or be empty"
+object(ArrayObject)#%d (0) {
+}
+===DONE===