From: Ilia Alshanetsky <iliaa@php.net>
Date: Mon, 2 Jan 2006 22:19:53 +0000 (+0000)
Subject: MFB51: Fixed possible crash in apache_getenv()/apache_setenv() on invalid
X-Git-Tag: RELEASE_1_0_4~151
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=331253e7e6ec0ac8c32c0cebf812a9bca465adfe;p=php

MFB51: Fixed possible crash in apache_getenv()/apache_setenv() on invalid
parameters.
---

diff --git a/sapi/apache2handler/php_functions.c b/sapi/apache2handler/php_functions.c
index f6a0cab4d3..0ff80b7d25 100644
--- a/sapi/apache2handler/php_functions.c
+++ b/sapi/apache2handler/php_functions.c
@@ -264,10 +264,13 @@ PHP_FUNCTION(apache_setenv)
 	ctx = SG(server_context);
 
 	r = ctx->r;
-	if (arg_count == 3 && Z_STRVAL_PP(walk_to_top)) {
-		while(r->prev) {
-			r = r->prev;
-		}	
+	if (arg_count == 3) {
+		convert_to_boolean_ex(walk_to_top);
+		if (Z_LVAL_PP(walk_to_top)) {
+			while(r->prev) {
+				r = r->prev;
+			}
+		}
 	}
 
 	convert_to_string_ex(variable);
@@ -300,10 +303,13 @@ PHP_FUNCTION(apache_getenv)
 	ctx = SG(server_context);
 
 	r = ctx->r;
-	if (arg_count == 2 && Z_STRVAL_PP(walk_to_top)) {
-		while(r->prev) {
-			r = r->prev;
-		}	
+	if (arg_count == 2) {
+		convert_to_boolean_ex(walk_to_top);
+		if (Z_LVAL_PP(walk_to_top)) {
+			while(r->prev) {
+				r = r->prev;
+			}
+		}
 	}
 
 	convert_to_string_ex(variable);