MFH: fix crash bug in chown when 2nd parameter != string or int

diff --git a/ext/standard/filestat.c b/ext/standard/filestat.c
index 81663a15d1053764e5eed6903f5d04aec953c3ec..e38216c37c50c9cdb27fc2316ac6898180a7a33b 100644 (file)
--- a/ext/standard/filestat.c
+++ b/ext/standard/filestat.c
@@ -430,7 +430,7 @@ static void php_do_chgrp(INTERNAL_FUNCTION_PARAMETERS, int do_lchgrp) /* {{{ */
                gid = gr->gr_gid;
 #endif
        } else {
-               php_error_docref(NULL TSRMLS_CC, E_WARNING, "parameter 2 should be string or integer, %s given",zend_zval_type_name(group));
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "parameter 2 should be string or integer, %s given", zend_zval_type_name(group));
                RETURN_FALSE;
        }
 
@@ -502,7 +502,7 @@ static void php_do_chown(INTERNAL_FUNCTION_PARAMETERS, int do_lchown) /* {{{ */
 
        if (Z_TYPE_P(user) == IS_LONG) {
                uid = (uid_t)Z_LVAL_P(user);
-       } else {
+       } else if (Z_TYPE_P(user) == IS_STRING) {
 #if defined(ZTS) && defined(_SC_GETPW_R_SIZE_MAX) && defined(HAVE_GETPWNAM_R)
                struct passwd pw;
                struct passwd *retpwptr = NULL;
@@ -530,9 +530,12 @@ static void php_do_chown(INTERNAL_FUNCTION_PARAMETERS, int do_lchown) /* {{{ */
                }
                uid = pw->pw_uid;
 #endif
+       } else {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "parameter 2 should be string or integer, %s given", zend_zval_type_name(user));
+               RETURN_FALSE;
        }
 
-       if (PG(safe_mode) &&(!php_checkuid(filename, NULL, CHECKUID_ALLOW_FILE_NOT_EXISTS))) {
+       if (PG(safe_mode) && (!php_checkuid(filename, NULL, CHECKUID_ALLOW_FILE_NOT_EXISTS))) {
                RETURN_FALSE;
        }