From: Dmitry Stogov <dmitry@php.net>
Date: Wed, 12 May 2010 11:10:06 +0000 (+0000)
Subject: Fixed a possible information leak because of interruption of XOR operator
X-Git-Tag: php-5.3.3RC1~176
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f94a437d9d3740206756d92d2563f93447b5a0ae;p=php

Fixed a possible information leak because of interruption of XOR operator
---

diff --git a/NEWS b/NEWS
index 933880840a..33c1f0d4a0 100644
--- a/NEWS
+++ b/NEWS
@@ -23,6 +23,8 @@ PHP                                                                        NEWS
 - Fixed very rare memory leak in mysqlnd, when binding thousands of columns.
   (Andrey)
 
+- Fixed a possible information leak because of interruption of XOR operator.
+  Reported by Stefan Esser (Dmitry)
 - Fixed a possible memory corruption because of unexpected call-time pass by
   refernce and following memory clobbering through callbacks.
   Reported by Stefan Esser (Dmitry)
diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 8af1edee50..7ce2e6283a 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -965,8 +965,10 @@ ZEND_API int div_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ *
 ZEND_API int mod_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	zendi_convert_to_long(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_long(op2, op2_copy, result);
 
 	if (Z_LVAL_P(op2) == 0) {
@@ -981,7 +983,7 @@ ZEND_API int mod_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ *
 		return SUCCESS;
 	}
 
-	ZVAL_LONG(result, Z_LVAL_P(op1) % Z_LVAL_P(op2));
+	ZVAL_LONG(result, op1_lval % Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */
@@ -989,10 +991,12 @@ ZEND_API int mod_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ *
 ZEND_API int boolean_xor_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	zendi_convert_to_boolean(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_boolean(op2, op2_copy, result);
-	ZVAL_BOOL(result, Z_LVAL_P(op1) ^ Z_LVAL_P(op2));
+	ZVAL_BOOL(result, op1_lval ^ Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */
@@ -1038,6 +1042,7 @@ ZEND_API int bitwise_not_function(zval *result, zval *op1 TSRMLS_DC) /* {{{ */
 ZEND_API int bitwise_or_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	if (Z_TYPE_P(op1) == IS_STRING && Z_TYPE_P(op2) == IS_STRING) {
 		zval *longer, *shorter;
@@ -1066,9 +1071,10 @@ ZEND_API int bitwise_or_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /
 		return SUCCESS;
 	}
 	zendi_convert_to_long(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_long(op2, op2_copy, result);
 
-	ZVAL_LONG(result, Z_LVAL_P(op1) | Z_LVAL_P(op2));
+	ZVAL_LONG(result, op1_lval | Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */
@@ -1076,6 +1082,7 @@ ZEND_API int bitwise_or_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /
 ZEND_API int bitwise_and_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	if (Z_TYPE_P(op1) == IS_STRING && Z_TYPE_P(op2) == IS_STRING) {
 		zval *longer, *shorter;
@@ -1106,9 +1113,10 @@ ZEND_API int bitwise_and_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 
 
 	zendi_convert_to_long(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_long(op2, op2_copy, result);
 
-	ZVAL_LONG(result, Z_LVAL_P(op1) & Z_LVAL_P(op2));
+	ZVAL_LONG(result, op1_lval & Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */
@@ -1116,6 +1124,7 @@ ZEND_API int bitwise_and_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 ZEND_API int bitwise_xor_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	if (Z_TYPE_P(op1) == IS_STRING && Z_TYPE_P(op2) == IS_STRING) {
 		zval *longer, *shorter;
@@ -1145,9 +1154,10 @@ ZEND_API int bitwise_xor_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 	}
 
 	zendi_convert_to_long(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_long(op2, op2_copy, result);
 
-	ZVAL_LONG(result, Z_LVAL_P(op1) ^ Z_LVAL_P(op2));
+	ZVAL_LONG(result, op1_lval ^ Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */
@@ -1155,10 +1165,12 @@ ZEND_API int bitwise_xor_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 ZEND_API int shift_left_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	zendi_convert_to_long(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_long(op2, op2_copy, result);
-	ZVAL_LONG(result, Z_LVAL_P(op1) << Z_LVAL_P(op2));
+	ZVAL_LONG(result, op1_lval << Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */
@@ -1166,10 +1178,12 @@ ZEND_API int shift_left_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /
 ZEND_API int shift_right_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	zendi_convert_to_long(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_long(op2, op2_copy, result);
-	ZVAL_LONG(result, Z_LVAL_P(op1) >> Z_LVAL_P(op2));
+	ZVAL_LONG(result, op1_lval >> Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */