MFH: Fixed bug #34456 (Possible crash inside pspell extension).

diff --git a/NEWS b/NEWS
index 9efef9c066f63e14445a0a96d06a5782bd8c1a24..e07d1d0d325f82f2ee27340df27a9716d0e9b81c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -25,6 +25,7 @@ PHP                                                                        NEWS
 - Fixed "make test" to work for phpized extensions. (Hartmut, Jani)
 - Fixed failing queries (FALSE returned) with mysqli_query() on 64 bit systems.
   (Andrey)
+- Fixed bug #34456 (Possible crash inside pspell extension). (Nuno)
 - Fixed bug #34449 (ext/soap: XSD_ANYXML functionality not exposed). (Dmitry)
 - Fixed bug #34420 (Possible crash inside curl_multi_remove_handle()). (Ilia)
 - Fixed bug #34331 (php crashes when variables_order is empty). (Ilia)

diff --git a/ext/pspell/pspell.c b/ext/pspell/pspell.c
index 63e6d3e7be0011bc54ee2c3fe4f30379e057a535..8e9f5470a6b9b155a391c896dd3d54f8c057ee6f 100644 (file)
--- a/ext/pspell/pspell.c
+++ b/ext/pspell/pspell.c
@@ -697,6 +697,7 @@ PHP_FUNCTION(pspell_config_runtogether)
        zval **sccin, **runtogether;
        int argc;
 
+       PspellManager *manager;
        PspellConfig *config;
        
        argc = ZEND_NUM_ARGS();
@@ -705,12 +706,13 @@ PHP_FUNCTION(pspell_config_runtogether)
        }
 
        convert_to_long_ex(sccin);
-       config = (PspellConfig *) zend_list_find(Z_LVAL_PP(sccin), &type);
-       if(!config){
+       manager = (PspellManager *) zend_list_find(Z_LVAL_PP(sccin), &type);
+       if(!manager){
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "%ld is not a PSPELL config index", Z_LVAL_PP(sccin));
                RETURN_FALSE;
        }
 
+       config = pspell_manager_config(manager);
        convert_to_boolean_ex(runtogether);
        pspell_config_replace(config, "run-together", Z_LVAL_PP(runtogether) ? "true" : "false");
        
@@ -726,6 +728,7 @@ PHP_FUNCTION(pspell_config_mode)
        zval **sccin, **mode;
        int argc;
 
+       PspellManager *manager;
        PspellConfig *config;
        
        argc = ZEND_NUM_ARGS();
@@ -734,12 +737,13 @@ PHP_FUNCTION(pspell_config_mode)
        }
 
        convert_to_long_ex(sccin);
-       config = (PspellConfig *) zend_list_find(Z_LVAL_PP(sccin), &type);
-       if(!config){
+       manager = (PspellManager *) zend_list_find(Z_LVAL_PP(sccin), &type);
+       if(!manager){
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "%ld is not a PSPELL config index", Z_LVAL_PP(sccin));
                RETURN_FALSE;
        }
 
+       config = pspell_manager_config(manager);
        convert_to_long_ex(mode);
 
        /* First check what mode we want (how many suggestions) */
@@ -767,6 +771,7 @@ PHP_FUNCTION(pspell_config_ignore)
        char ignore_str[PSPELL_LARGEST_WORD + 1];       
        long ignore = 0L;
 
+       PspellManager *manager;
        PspellConfig *config;
        
        argc = ZEND_NUM_ARGS();
@@ -775,12 +780,13 @@ PHP_FUNCTION(pspell_config_ignore)
        }
 
        convert_to_long_ex(sccin);
-       config = (PspellConfig *) zend_list_find(Z_LVAL_PP(sccin), &type);
-       if(!config){
+       manager = (PspellManager *) zend_list_find(Z_LVAL_PP(sccin), &type);
+       if(!manager){
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "%ld is not a PSPELL config index", Z_LVAL_PP(sccin));
                RETURN_FALSE;
        }
 
+       config = pspell_manager_config(manager);
        convert_to_long_ex(pignore);
        ignore = Z_LVAL_PP(pignore);
 
@@ -810,6 +816,7 @@ static void pspell_config_path(INTERNAL_FUNCTION_PARAMETERS, char *option)
        int type;
        zval **sccin, **value;
        int argc;
+       PspellManager *manager;
        PspellConfig *config;
        
        argc = ZEND_NUM_ARGS();
@@ -818,12 +825,13 @@ static void pspell_config_path(INTERNAL_FUNCTION_PARAMETERS, char *option)
        }
 
        convert_to_long_ex(sccin);
-       config = (PspellConfig *) zend_list_find(Z_LVAL_PP(sccin), &type);
-       if (!config) {
+       manager = (PspellManager *) zend_list_find(Z_LVAL_PP(sccin), &type);
+       if (!manager) {
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "%ld is not a PSPELL config index", Z_LVAL_PP(sccin));
                RETURN_FALSE;
        }
 
+       config = pspell_manager_config(manager);
        convert_to_string_ex(value);
 
        if (PG(safe_mode) && (!php_checkuid(Z_STRVAL_PP(value), NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
@@ -871,6 +879,7 @@ PHP_FUNCTION(pspell_config_repl)
        zval **sccin, **repl;
        int argc;
 
+       PspellManager *manager;
        PspellConfig *config;
        
        argc = ZEND_NUM_ARGS();
@@ -879,12 +888,13 @@ PHP_FUNCTION(pspell_config_repl)
        }
 
        convert_to_long_ex(sccin);
-       config = (PspellConfig *) zend_list_find(Z_LVAL_PP(sccin), &type);
-       if(!config){
+       manager = (PspellManager *) zend_list_find(Z_LVAL_PP(sccin), &type);
+       if(!manager){
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "%ld is not a PSPELL config index", Z_LVAL_PP(sccin));
                RETURN_FALSE;
        }
 
+       config = pspell_manager_config(manager);
        pspell_config_replace(config, "save-repl", "true");
 
        convert_to_string_ex(repl);
@@ -911,6 +921,7 @@ PHP_FUNCTION(pspell_config_save_repl)
        zval **sccin, **save;
        int argc;
 
+       PspellManager *manager;
        PspellConfig *config;
        
        argc = ZEND_NUM_ARGS();
@@ -919,12 +930,13 @@ PHP_FUNCTION(pspell_config_save_repl)
        }
 
        convert_to_long_ex(sccin);
-       config = (PspellConfig *) zend_list_find(Z_LVAL_PP(sccin), &type);
-       if(!config){
+       manager = (PspellManager *) zend_list_find(Z_LVAL_PP(sccin), &type);
+       if(!manager){
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "%ld is not a PSPELL config index", Z_LVAL_PP(sccin));
                RETURN_FALSE;
        }
 
+       config = pspell_manager_config(manager);
        convert_to_boolean_ex(save);
        pspell_config_replace(config, "save-repl", Z_LVAL_PP(save) ? "true" : "false");