From: Anatol Belski <ab@php.net>
Date: Mon, 12 Dec 2016 00:26:06 +0000 (+0100)
Subject: fix datatype for zpp, yet a followup on bug #73679
X-Git-Tag: php-7.1.1RC1~103^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=3473b519c0337937a7d667273ec971825db9ea6a;p=php

fix datatype for zpp, yet a followup on bug #73679
---

diff --git a/ext/com_dotnet/com_com.c b/ext/com_dotnet/com_com.c
index ec1c72191c..86b3bd1dd5 100644
--- a/ext/com_dotnet/com_com.c
+++ b/ext/com_dotnet/com_com.c
@@ -52,6 +52,7 @@ PHP_FUNCTION(com_create_instance)
 		RPC_C_AUTHN_LEVEL_DEFAULT, RPC_C_IMP_LEVEL_IMPERSONATE,
 		&authid, EOAC_NONE
 	};
+	zend_long cp = CP_ACP;
 
 	php_com_initialize();
 	obj = CDNO_FETCH(object);
@@ -59,16 +60,22 @@ PHP_FUNCTION(com_create_instance)
 	if (FAILURE == zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET,
 			ZEND_NUM_ARGS(), "s|s!ls",
 			&module_name, &module_name_len, &server_name, &server_name_len,
-			&obj->code_page, &typelib_name, &typelib_name_len) &&
+			&cp, &typelib_name, &typelib_name_len) &&
 		FAILURE == zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET,
 			ZEND_NUM_ARGS(), "sa|ls",
-			&module_name, &module_name_len, &server_params, &obj->code_page,
+			&module_name, &module_name_len, &server_params, &cp,
 			&typelib_name, &typelib_name_len)) {
 
 		php_com_throw_exception(E_INVALIDARG, "Could not create COM object - invalid arguments!");
 		return;
 	}
 
+	if (Z_L(0) > cp || ZEND_LONG_INT_OVFL(cp)) {
+		php_com_throw_exception(E_INVALIDARG, "Could not create COM object - invalid codepage!");
+		return;
+	}
+	obj->code_page = (int)cp;
+
 	if (server_name) {
 		ctx = CLSCTX_REMOTE_SERVER;
 	} else if (server_params) {