From: Felipe Pena <felipe@php.net>
Date: Tue, 7 Oct 2008 18:23:05 +0000 (+0000)
Subject: - MFH: Fixed bug #45575 (Segfault with invalid non-string as event handler callback)
X-Git-Tag: php-5.2.7RC1~3
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4237bea6fed17112ef631ee5dabd316219f69e28;p=php

- MFH: Fixed bug #45575 (Segfault with invalid non-string as event handler callback)
  patch by Christian seiler
---

diff --git a/NEWS b/NEWS
index 07b1bd60c9..415a81c158 100644
--- a/NEWS
+++ b/NEWS
@@ -62,6 +62,8 @@ PHP                                                                        NEWS
   requests). (Moriyoshi)
 - Fixed bug #45581 (htmlspecialchars() double encoding &#x hex items). (Arnaud)
 - Fixed bug #45580 (levenshtein() crashes with invalid argument). (Ilia)
+- Fixed bug #45575 (Segfault with invalid non-string as event handler callback).
+  (Christian Seiler)
 - Fixed bug #45568 (ISAPI doesn't properly clear auth_digest in header).
   (Patch by: navara at emclient dot com)
 - Fixed bug #45556 (Return value from callback isn't freed). (Felipe)
diff --git a/ext/interbase/ibase_events.c b/ext/interbase/ibase_events.c
index e4408142f8..c1a295dd63 100644
--- a/ext/interbase/ibase_events.c
+++ b/ext/interbase/ibase_events.c
@@ -260,7 +260,7 @@ PHP_FUNCTION(ibase_set_event_handler)
 	 * link resource id (int) as arguments. The value returned from the function is
 	 * used to determine if the event handler should remain set.
 	 */
-
+	char *cb_name;
 	zval **args[17], **cb_arg;
 	ibase_db_link *ib_link;
 	ibase_event *event;
@@ -312,11 +312,12 @@ PHP_FUNCTION(ibase_set_event_handler)
 	}
 
 	/* get the callback */
-	if (!zend_is_callable(*cb_arg, 0, NULL)) {
-		_php_ibase_module_error("Callback argument %s is not a callable function"
-			TSRMLS_CC, Z_STRVAL_PP(cb_arg));
+	if (!zend_is_callable(*cb_arg, 0, &cb_name)) {
+		_php_ibase_module_error("Callback argument %s is not a callable function" TSRMLS_CC, cb_name);
+		efree(cb_name);
 		RETURN_FALSE;
 	}
+	efree(cb_name);
 
 	/* allocate the event resource */
 	event = (ibase_event *) safe_emalloc(sizeof(ibase_event), 1, 0);
diff --git a/ext/interbase/tests/bug45575.phpt b/ext/interbase/tests/bug45575.phpt
new file mode 100644
index 0000000000..ca0fa831e0
--- /dev/null
+++ b/ext/interbase/tests/bug45575.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #45575 (Segfault with invalid non-string as event handler callback)
+--SKIPIF--
+<?php include("skipif.inc"); ?>
+--FILE--
+<?php
+
+require("interbase.inc");
+
+$db = ibase_connect($test_base);
+
+function foobar($var) { var_dump($var); return true; }
+
+ibase_set_event_handler($db, null, 'TEST1');
+ibase_set_event_handler($db, 1, 'TEST1');
+ibase_set_event_handler('foobar', 'TEST1');
+
+?>
+--EXPECTF--
+Warning: ibase_set_event_handler(): Callback argument  is not a callable function in %s on line %d
+
+Warning: ibase_set_event_handler(): Callback argument 1 is not a callable function in %s on line %d