- MFH: Fixed bug #45575 (Segfault with invalid non-string as event handler callback)

  patch by Christian seiler

diff --git a/NEWS b/NEWS
index 07b1bd60c95f676fd2eb23a25e70f549bf69cb1d..415a81c158d7b211b601e492d35f5ba5e0c0a982 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -62,6 +62,8 @@ PHP                                                                        NEWS
   requests). (Moriyoshi)
 - Fixed bug #45581 (htmlspecialchars() double encoding &#x hex items). (Arnaud)
 - Fixed bug #45580 (levenshtein() crashes with invalid argument). (Ilia)
+- Fixed bug #45575 (Segfault with invalid non-string as event handler callback).
+  (Christian Seiler)
 - Fixed bug #45568 (ISAPI doesn't properly clear auth_digest in header).
   (Patch by: navara at emclient dot com)
 - Fixed bug #45556 (Return value from callback isn't freed). (Felipe)

diff --git a/ext/interbase/ibase_events.c b/ext/interbase/ibase_events.c
index e4408142f8225f5e0909f4b6ed36afd1ef29f601..c1a295dd634f25e7c73252c2280b23a307479562 100644 (file)
--- a/ext/interbase/ibase_events.c
+++ b/ext/interbase/ibase_events.c
@@ -260,7 +260,7 @@ PHP_FUNCTION(ibase_set_event_handler)
         * link resource id (int) as arguments. The value returned from the function is
         * used to determine if the event handler should remain set.
         */
-
+       char *cb_name;
        zval **args[17], **cb_arg;
        ibase_db_link *ib_link;
        ibase_event *event;
@@ -312,11 +312,12 @@ PHP_FUNCTION(ibase_set_event_handler)
        }
 
        /* get the callback */
-       if (!zend_is_callable(*cb_arg, 0, NULL)) {
-               _php_ibase_module_error("Callback argument %s is not a callable function"
-                       TSRMLS_CC, Z_STRVAL_PP(cb_arg));
+       if (!zend_is_callable(*cb_arg, 0, &cb_name)) {
+               _php_ibase_module_error("Callback argument %s is not a callable function" TSRMLS_CC, cb_name);
+               efree(cb_name);
                RETURN_FALSE;
        }
+       efree(cb_name);
 
        /* allocate the event resource */
        event = (ibase_event *) safe_emalloc(sizeof(ibase_event), 1, 0);

diff --git a/ext/interbase/tests/bug45575.phpt b/ext/interbase/tests/bug45575.phpt
new file mode 100644 (file)
index 0000000..ca0fa83
--- /dev/null
+++ b/ext/interbase/tests/bug45575.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #45575 (Segfault with invalid non-string as event handler callback)
+--SKIPIF--
+<?php include("skipif.inc"); ?>
+--FILE--
+<?php
+
+require("interbase.inc");
+
+$db = ibase_connect($test_base);
+
+function foobar($var) { var_dump($var); return true; }
+
+ibase_set_event_handler($db, null, 'TEST1');
+ibase_set_event_handler($db, 1, 'TEST1');
+ibase_set_event_handler('foobar', 'TEST1');
+
+?>
+--EXPECTF--
+Warning: ibase_set_event_handler(): Callback argument  is not a callable function in %s on line %d
+
+Warning: ibase_set_event_handler(): Callback argument 1 is not a callable function in %s on line %d