]> granicus.if.org Git - php/commitdiff
Fixed possible NULL pointer dereference
authorXinchen Hui <laruence@gmail.com>
Wed, 19 Feb 2014 11:33:10 +0000 (19:33 +0800)
committerXinchen Hui <laruence@gmail.com>
Wed, 19 Feb 2014 11:33:10 +0000 (19:33 +0800)
Zend/zend_object_handlers.c

index 7cb16e18bd9c473476fa15ef9632ca61b7401481..a3a024ba1bcc2e8384188ed6d6e3a30a3a3ff39f 100644 (file)
@@ -1408,21 +1408,22 @@ static int zend_std_has_property(zval *object, zval *member, int has_set_exists,
                        goto found;
                }
                if (UNEXPECTED(zobj->properties != NULL)) {
-                       value = zend_hash_find(zobj->properties, property_info->name);
+                       if ((value = zend_hash_find(zobj->properties, property_info->name)) != NULL) {
 found:
-                       switch (has_set_exists) {
-                               case 0:
-                                       result = (Z_TYPE_P(value) != IS_NULL);
-                                       break;
-                               default:
-                                       result = zend_is_true(value TSRMLS_CC);
-                                       break;
-                               case 2:
-                                       result = 1;
-                                       break;
+                               switch (has_set_exists) {
+                                       case 0:
+                                               result = (Z_TYPE_P(value) != IS_NULL);
+                                               break;
+                                       default:
+                                               result = zend_is_true(value TSRMLS_CC);
+                                               break;
+                                       case 2:
+                                               result = 1;
+                                               break;
+                               }
                        }
+                       goto exit;
                }
-               goto exit;
        }
 
        result = 0;