MFH: Fixed possible crash in apache_getenv()/apache_setenv() on invalid

parameters.

diff --git a/sapi/apache2handler/php_functions.c b/sapi/apache2handler/php_functions.c
index 871b1992cce4e851ff720bdb34be7a89f2cc16a8..88e697932b90f9f95d19ddd12727ecd71de4f194 100644 (file)
--- a/sapi/apache2handler/php_functions.c
+++ b/sapi/apache2handler/php_functions.c
@@ -263,10 +263,13 @@ PHP_FUNCTION(apache_setenv)
        ctx = SG(server_context);
 
        r = ctx->r;
-       if (arg_count == 3 && Z_STRVAL_PP(walk_to_top)) {
-               while(r->prev) {
-                       r = r->prev;
-               }       
+       if (arg_count == 3) {
+               convert_to_boolean_ex(walk_to_top);
+               if (Z_LVAL_PP(walk_to_top)) {
+                       while(r->prev) {
+                               r = r->prev;
+                       }
+               }
        }
 
        convert_to_string_ex(variable);
@@ -299,10 +302,13 @@ PHP_FUNCTION(apache_getenv)
        ctx = SG(server_context);
 
        r = ctx->r;
-       if (arg_count == 2 && Z_STRVAL_PP(walk_to_top)) {
-               while(r->prev) {
-                       r = r->prev;
-               }       
+       if (arg_count == 2) {
+               convert_to_boolean_ex(walk_to_top);
+               if (Z_LVAL_PP(walk_to_top)) {
+                       while(r->prev) {
+                               r = r->prev;
+                       }
+               }
        }
 
        convert_to_string_ex(variable);