From: Antony Dovgal Date: Sun, 9 Jan 2005 17:42:02 +0000 (+0000) Subject: fix bug #31454 (session_set_save_handler crashes PHP when supplied non-existent objec... X-Git-Tag: RELEASE_0_2~367 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c644b2a5a18c7f3e1fc1e466fa359a7bec0cb253;p=php fix bug #31454 (session_set_save_handler crashes PHP when supplied non-existent object ref) --- diff --git a/ext/session/session.c b/ext/session/session.c index 26181a87dd..c673412d06 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -1361,6 +1361,7 @@ PHP_FUNCTION(session_set_save_handler) zval **args[6]; int i; ps_user *mdata; + char *name; if (ZEND_NUM_ARGS() != 6 || zend_get_parameters_array_ex(6, args) == FAILURE) WRONG_PARAM_COUNT; @@ -1368,6 +1369,14 @@ PHP_FUNCTION(session_set_save_handler) if (PS(session_status) != php_session_none) RETURN_FALSE; + for (i = 0; i < 6; i++) { + if (!zend_is_callable(*args[i], 0, &name)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Argument %d is not a valid callback", i+1); + efree(name); + RETURN_FALSE; + } + } + zend_alter_ini_entry("session.save_handler", sizeof("session.save_handler"), "user", sizeof("user")-1, PHP_INI_USER, PHP_INI_STAGE_RUNTIME); mdata = emalloc(sizeof(*mdata));