Fixed a possible information leak because of interruption of XOR operator

diff --git a/NEWS b/NEWS
index 933880840a6bd11d2ca5387874260ae83fe973f8..33c1f0d4a02d0a20b9f2e14f3787b6e6582d1985 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -23,6 +23,8 @@ PHP                                                                        NEWS
 - Fixed very rare memory leak in mysqlnd, when binding thousands of columns.
   (Andrey)
 
+- Fixed a possible information leak because of interruption of XOR operator.
+  Reported by Stefan Esser (Dmitry)
 - Fixed a possible memory corruption because of unexpected call-time pass by
   refernce and following memory clobbering through callbacks.
   Reported by Stefan Esser (Dmitry)

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 8af1edee50f19b275b3a2bd27da79a94843f1fb3..7ce2e6283ad6d7e1219aaec56786d65488f018ff 100644 (file)
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -965,8 +965,10 @@ ZEND_API int div_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ *
 ZEND_API int mod_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
        zval op1_copy, op2_copy;
+       long op1_lval;
 
        zendi_convert_to_long(op1, op1_copy, result);
+       op1_lval = Z_LVAL_P(op1);
        zendi_convert_to_long(op2, op2_copy, result);
 
        if (Z_LVAL_P(op2) == 0) {
@@ -981,7 +983,7 @@ ZEND_API int mod_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ *
                return SUCCESS;
        }
 
-       ZVAL_LONG(result, Z_LVAL_P(op1) % Z_LVAL_P(op2));
+       ZVAL_LONG(result, op1_lval % Z_LVAL_P(op2));
        return SUCCESS;
 }
 /* }}} */
@@ -989,10 +991,12 @@ ZEND_API int mod_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ *
 ZEND_API int boolean_xor_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
        zval op1_copy, op2_copy;
+       long op1_lval;
 
        zendi_convert_to_boolean(op1, op1_copy, result);
+       op1_lval = Z_LVAL_P(op1);
        zendi_convert_to_boolean(op2, op2_copy, result);
-       ZVAL_BOOL(result, Z_LVAL_P(op1) ^ Z_LVAL_P(op2));
+       ZVAL_BOOL(result, op1_lval ^ Z_LVAL_P(op2));
        return SUCCESS;
 }
 /* }}} */
@@ -1038,6 +1042,7 @@ ZEND_API int bitwise_not_function(zval *result, zval *op1 TSRMLS_DC) /* {{{ */
 ZEND_API int bitwise_or_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
        zval op1_copy, op2_copy;
+       long op1_lval;
 
        if (Z_TYPE_P(op1) == IS_STRING && Z_TYPE_P(op2) == IS_STRING) {
                zval *longer, *shorter;
@@ -1066,9 +1071,10 @@ ZEND_API int bitwise_or_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /
                return SUCCESS;
        }
        zendi_convert_to_long(op1, op1_copy, result);
+       op1_lval = Z_LVAL_P(op1);
        zendi_convert_to_long(op2, op2_copy, result);
 
-       ZVAL_LONG(result, Z_LVAL_P(op1) | Z_LVAL_P(op2));
+       ZVAL_LONG(result, op1_lval | Z_LVAL_P(op2));
        return SUCCESS;
 }
 /* }}} */
@@ -1076,6 +1082,7 @@ ZEND_API int bitwise_or_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /
 ZEND_API int bitwise_and_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
        zval op1_copy, op2_copy;
+       long op1_lval;
 
        if (Z_TYPE_P(op1) == IS_STRING && Z_TYPE_P(op2) == IS_STRING) {
                zval *longer, *shorter;
@@ -1106,9 +1113,10 @@ ZEND_API int bitwise_and_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 
 
        zendi_convert_to_long(op1, op1_copy, result);
+       op1_lval = Z_LVAL_P(op1);
        zendi_convert_to_long(op2, op2_copy, result);
 
-       ZVAL_LONG(result, Z_LVAL_P(op1) & Z_LVAL_P(op2));
+       ZVAL_LONG(result, op1_lval & Z_LVAL_P(op2));
        return SUCCESS;
 }
 /* }}} */
@@ -1116,6 +1124,7 @@ ZEND_API int bitwise_and_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 ZEND_API int bitwise_xor_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
        zval op1_copy, op2_copy;
+       long op1_lval;
 
        if (Z_TYPE_P(op1) == IS_STRING && Z_TYPE_P(op2) == IS_STRING) {
                zval *longer, *shorter;
@@ -1145,9 +1154,10 @@ ZEND_API int bitwise_xor_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
        }
 
        zendi_convert_to_long(op1, op1_copy, result);
+       op1_lval = Z_LVAL_P(op1);
        zendi_convert_to_long(op2, op2_copy, result);
 
-       ZVAL_LONG(result, Z_LVAL_P(op1) ^ Z_LVAL_P(op2));
+       ZVAL_LONG(result, op1_lval ^ Z_LVAL_P(op2));
        return SUCCESS;
 }
 /* }}} */
@@ -1155,10 +1165,12 @@ ZEND_API int bitwise_xor_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 ZEND_API int shift_left_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
        zval op1_copy, op2_copy;
+       long op1_lval;
 
        zendi_convert_to_long(op1, op1_copy, result);
+       op1_lval = Z_LVAL_P(op1);
        zendi_convert_to_long(op2, op2_copy, result);
-       ZVAL_LONG(result, Z_LVAL_P(op1) << Z_LVAL_P(op2));
+       ZVAL_LONG(result, op1_lval << Z_LVAL_P(op2));
        return SUCCESS;
 }
 /* }}} */
@@ -1166,10 +1178,12 @@ ZEND_API int shift_left_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /
 ZEND_API int shift_right_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
        zval op1_copy, op2_copy;
+       long op1_lval;
 
        zendi_convert_to_long(op1, op1_copy, result);
+       op1_lval = Z_LVAL_P(op1);
        zendi_convert_to_long(op2, op2_copy, result);
-       ZVAL_LONG(result, Z_LVAL_P(op1) >> Z_LVAL_P(op2));
+       ZVAL_LONG(result, op1_lval >> Z_LVAL_P(op2));
        return SUCCESS;
 }
 /* }}} */