- Fixed bug #45575 (Segfault with invalid non-string as event handler callback)

  patch by Christian seiler

diff --git a/ext/interbase/ibase_events.c b/ext/interbase/ibase_events.c
index b0f5763d927c3ed0bb46ab6226529e7ea24cb8b8..5364f687007cd14790d42ec1fe8de788556c5554 100644 (file)
--- a/ext/interbase/ibase_events.c
+++ b/ext/interbase/ibase_events.c
@@ -260,7 +260,7 @@ PHP_FUNCTION(ibase_set_event_handler)
         * link resource id (int) as arguments. The value returned from the function is
         * used to determine if the event handler should remain set.
         */
-
+       zval cb_name;
        zval **args[17], **cb_arg;
        ibase_db_link *ib_link;
        ibase_event *event;
@@ -279,7 +279,7 @@ PHP_FUNCTION(ibase_set_event_handler)
        }
 
        /* get a working link */
-       if (Z_TYPE_PP(args[0]) != IS_STRING) {
+       if (Z_TYPE_PP(args[0]) != IS_STRING && Z_TYPE_PP(args[0]) != IS_UNICODE) {
                /* resource, callback, event_1 [, ... event_15]
                 * No more than 15 events
                 */
@@ -312,11 +312,12 @@ PHP_FUNCTION(ibase_set_event_handler)
        }
 
        /* get the callback */
-       if (!zend_is_callable(*cb_arg, 0, NULL TSRMLS_CC)) {
-               _php_ibase_module_error("Callback argument %s is not a callable function"
-                       TSRMLS_CC, Z_STRVAL_PP(cb_arg));
+       if (!zend_is_callable(*cb_arg, 0, &cb_name TSRMLS_CC)) {
+               _php_ibase_module_error("Callback argument %v is not a callable function" TSRMLS_CC, Z_UNIVAL(cb_name));
+               zval_dtor(&cb_name);
                RETURN_FALSE;
        }
+       zval_dtor(&cb_name);
 
        /* allocate the event resource */
        event = (ibase_event *) safe_emalloc(sizeof(ibase_event), 1, 0);

diff --git a/ext/interbase/tests/bug45575.phpt b/ext/interbase/tests/bug45575.phpt
new file mode 100644 (file)
index 0000000..ca0fa83
--- /dev/null
+++ b/ext/interbase/tests/bug45575.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #45575 (Segfault with invalid non-string as event handler callback)
+--SKIPIF--
+<?php include("skipif.inc"); ?>
+--FILE--
+<?php
+
+require("interbase.inc");
+
+$db = ibase_connect($test_base);
+
+function foobar($var) { var_dump($var); return true; }
+
+ibase_set_event_handler($db, null, 'TEST1');
+ibase_set_event_handler($db, 1, 'TEST1');
+ibase_set_event_handler('foobar', 'TEST1');
+
+?>
+--EXPECTF--
+Warning: ibase_set_event_handler(): Callback argument  is not a callable function in %s on line %d
+
+Warning: ibase_set_event_handler(): Callback argument 1 is not a callable function in %s on line %d