Fixed bug #71221 (Null pointer deref (segfault) in get_defined_vars via ob_start)

diff --git a/NEWS b/NEWS
index ce1bf50d1671a27001b1e3e9852a23ec302f551d..776f289aa2a41f892ed59359f263668b06603b70 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2016 PHP 7.0.3
 
 - Core:
+  . Fixed bug #71221 (Null pointer deref (segfault) in get_defined_vars via
+    ob_start). (hugh at allthethings dot co dot nz)
   . Fixed bug #71201 (round() segfault on 64-bit builds). (Anatol)
   . Added support for new HTTP 451 code. (Julien)
 

diff --git a/Zend/tests/bug71221.phpt b/Zend/tests/bug71221.phpt
new file mode 100644 (file)
index 0000000..e735302
--- /dev/null
+++ b/Zend/tests/bug71221.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #71221 (Null pointer deref (segfault) in get_defined_vars via ob_start)
+--FILE--
+<?php 
+ob_start("get_defined_vars");
+ob_end_clean();
+?>
+okey
+--EXPECT--
+okey

diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index 6faa57cd99e2933758f54dccd26d2d85c08cb20c..785632ddbd1f70472507fe50d6bad9bedcc0947c 100644 (file)
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -1947,6 +1947,10 @@ ZEND_FUNCTION(get_defined_vars)
 {
        zend_array *symbol_table = zend_rebuild_symbol_table();
 
+       if (UNEXPECTED(symbol_table == NULL)) {
+               return;
+       }
+
        RETURN_ARR(zend_array_dup(symbol_table));
 }
 /* }}} */