MFH: Fixed bug#42090 (json_decode causes segmentation fault)

diff --git a/NEWS b/NEWS
index 5572655ab5e047e1408701d4c88eb9aa908d1933..e1795f0ea2580e5dbfbddc1ae3958d50ed968354 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -64,6 +64,7 @@ PHP                                                                        NEWS
 - Fixed PECL bug #11216 (crash in ZipArchive::addEmptyDir when a directory 
   already exists). (Pierre)
 
+- Fixed bug #42090 (json_decode causes segmentation fault). (Hannes)
 - Fixed bug #42072 (No warning message for clearstatcache() with arguments).
   (Ilia)
 - Fixed bug #42071 (ini scanner allows using NULL as option name). (Jani)

diff --git a/ext/json/json.c b/ext/json/json.c
index 5044f50b3402aae93444190aa6832374daa2925a..283021b36506b60f2c06d33841530dd0790dd4b9 100644 (file)
--- a/ext/json/json.c
+++ b/ext/json/json.c
@@ -470,7 +470,7 @@ static PHP_FUNCTION(json_decode)
                        RETURN_DOUBLE(d);
                }
        }
-       if (*parameter == '"' && parameter[parameter_len-1] == '"') {
+       if (parameter_len > 1 && *parameter == '"' && parameter[parameter_len-1] == '"') {
                RETURN_STRINGL(parameter+1, parameter_len-2, 1);
        } else if (*parameter == '{' || *parameter == '[') { /* invalid JSON string */
                RETURN_NULL();

diff --git a/ext/json/tests/bug42090.phpt b/ext/json/tests/bug42090.phpt
new file mode 100644 (file)
index 0000000..bccd28a
--- /dev/null
+++ b/ext/json/tests/bug42090.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug#42090 (json_decode causes segmentation fault)
+--SKIPIF--
+<?php if (!extension_loaded("json")) print "skip"; ?>
+--FILE--
+<?php
+var_dump(
+       json_decode('""'),
+       json_decode('"..".'),
+       json_decode('"'),
+       json_decode('""""'),
+       json_encode('"'),
+       json_decode(json_encode('"')),
+       json_decode(json_encode('""'))
+);
+?>
+--EXPECT--
+string(0) ""
+string(5) "".."."
+string(1) """
+string(2) """"
+string(4) ""\"""
+string(1) """
+string(2) """"
+