Fixed bug #77395 (segfault about array_multisort)

diff --git a/NEWS b/NEWS
index 552c94d13668936548667129debf5617113cb3b7..4cdbf466f5f131d97473eebb223befe9fcb136f8 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,9 @@ PHP                                                                        NEWS
   . Fixed bug #76839 (socket_recvfrom may return an invalid 'from' address
     on MacOS). (Michael Meyer)
 
+- Standard:
+  . Fixed bug #77395 (segfault about array_multisort). (Laruence)
+
 03 Jan 2019, PHP 7.2.14
 
 - Core:

diff --git a/ext/standard/array.c b/ext/standard/array.c
index dfff41b6aaf515532b0fb3b92d5bd65fd1f29b64..e810defcdaf73e4fc9d517bab47ee169007e8122 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -5555,7 +5555,7 @@ PHPAPI int php_multisort_compare(const void *a, const void *b) /* {{{ */
 /* }}} */
 
 #define MULTISORT_ABORT                                \
-       efree(ARRAYG(multisort_func));  \
+       efree(func);    \
        efree(arrays);                                  \
        RETURN_FALSE;
 
@@ -5587,6 +5587,7 @@ PHP_FUNCTION(array_multisort)
        int                             sort_order = PHP_SORT_ASC;
        int                             sort_type  = PHP_SORT_REGULAR;
        int                             i, k, n;
+       compare_func_t  *func;
 
        ZEND_PARSE_PARAMETERS_START(1, -1)
                Z_PARAM_VARIADIC('+', args, argc)
@@ -5597,7 +5598,7 @@ PHP_FUNCTION(array_multisort)
        for (i = 0; i < MULTISORT_LAST; i++) {
                parse_state[i] = 0;
        }
-       ARRAYG(multisort_func) = (compare_func_t*)ecalloc(argc, sizeof(compare_func_t));
+       func = ARRAYG(multisort_func) = (compare_func_t*)ecalloc(argc, sizeof(compare_func_t));
 
        /* Here we go through the input arguments and parse them. Each one can
         * be either an array or a sort flag which follows an array. If not
@@ -5681,7 +5682,7 @@ PHP_FUNCTION(array_multisort)
 
        /* If all arrays are empty we don't need to do anything. */
        if (array_size < 1) {
-               efree(ARRAYG(multisort_func));
+               efree(func);
                efree(arrays);
                RETURN_TRUE;
        }
@@ -5740,7 +5741,7 @@ PHP_FUNCTION(array_multisort)
                efree(indirect[i]);
        }
        efree(indirect);
-       efree(ARRAYG(multisort_func));
+       efree(func);
        efree(arrays);
        RETURN_TRUE;
 }

diff --git a/ext/standard/tests/array/bug77395.phpt b/ext/standard/tests/array/bug77395.phpt
new file mode 100644 (file)
index 0000000..7910e36
--- /dev/null
+++ b/ext/standard/tests/array/bug77395.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #77395 (segfault about array_multisort)
+--FILE--
+<?php
+function error_handle($level, $message, $file = '', $line = 0){
+       $a = [1,2,3];
+       $b = [3,2,1];
+       echo $message;
+       array_multisort($a, SORT_ASC, $b); // if comment this line, no segfault happen
+}
+set_error_handler('error_handle');
+$data = [['aa'=> 'bb',], ['aa'=> 'bb',],];
+array_multisort(array_column($data, 'bb'),SORT_DESC, $data); // PHP Warning error 
+?>
+--EXPECT--
+array_multisort(): Array sizes are inconsistent