From aca8fb1ca54f87875c6324ebd8891c9bfc83e125 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Mon, 2 Jan 2006 22:22:07 +0000 Subject: [PATCH] MFH: Fixed possible crash in apache_getenv()/apache_setenv() on invalid parameters. --- sapi/apache2handler/php_functions.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/sapi/apache2handler/php_functions.c b/sapi/apache2handler/php_functions.c index 871b1992cc..88e697932b 100644 --- a/sapi/apache2handler/php_functions.c +++ b/sapi/apache2handler/php_functions.c @@ -263,10 +263,13 @@ PHP_FUNCTION(apache_setenv) ctx = SG(server_context); r = ctx->r; - if (arg_count == 3 && Z_STRVAL_PP(walk_to_top)) { - while(r->prev) { - r = r->prev; - } + if (arg_count == 3) { + convert_to_boolean_ex(walk_to_top); + if (Z_LVAL_PP(walk_to_top)) { + while(r->prev) { + r = r->prev; + } + } } convert_to_string_ex(variable); @@ -299,10 +302,13 @@ PHP_FUNCTION(apache_getenv) ctx = SG(server_context); r = ctx->r; - if (arg_count == 2 && Z_STRVAL_PP(walk_to_top)) { - while(r->prev) { - r = r->prev; - } + if (arg_count == 2) { + convert_to_boolean_ex(walk_to_top); + if (Z_LVAL_PP(walk_to_top)) { + while(r->prev) { + r = r->prev; + } + } } convert_to_string_ex(variable); -- 2.50.1