|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2003-04-11 04:17 UTC] dimon at postmark dot net
function qq(&$type, &$details, &$file, &$line, $context){
echo "$details";
}
set_error_handler('qq');
user_error(str_repeat('q', 1025), E_USER_WARNING);
// will cause endless loop
set_error_handler(create_function('$type, &$details, $file, $line, $context', 'echo "$details";'));
user_error(str_repeat('q', 1025), E_USER_WARNING);
// will cause crash
// btw $context passed by reference will cause crash also
set_error_handler(create_function('$type, &$details, $file, $line, &$context', 'echo "$details";'));
user_error(str_repeat('q', 1024), E_USER_WARNING);
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Thu Apr 18 23:01:27 2024 UTC |
(where valid vsnprintf() implementation is missing.) case (a) and case (b): MS libc's vsnprintf() returns -1 if the resulting string has exceeded the limit length specified in the second parameter. This may cause segfaults in some cases like those. case (c): jay's suggestion looks like a valid fix to me since that's essentially a referenced variable. Here's the patch. Could anyone with ZE karma apply this one please? Index: Zend/zend.c =================================================================== RCS file: /repository/Zend/zend.c,v retrieving revision 1.162.2.2 diff -u -r1.162.2.2 zend.c --- Zend/zend.c 31 Dec 2002 16:22:56 -0000 1.162.2.2 +++ Zend/zend.c 2 May 2003 22:17:45 -0000 @@ -754,11 +754,14 @@ #ifdef HAVE_VSNPRINTF z_error_message->value.str.len = vsnprintf(z_error_message->value.str.val, ZEND_ERROR_BUFFER_SIZE, format, args); - if (z_error_message->value.str.len > ZEND_ERROR_BUFFER_SIZE-1) { + if (z_error_message->value.str.len < 0 || z_error_message->value.str.len > ZEND_ERROR_BUFFER_SIZE-1) { + z_error_message->value.str.val[ZEND_ERROR_BUFFER_SIZE-1] = '\0'; z_error_message->value.str.len = ZEND_ERROR_BUFFER_SIZE-1; } #else - strncpy(z_error_message->value.str.val, format, ZEND_ERROR_BUFFER_SIZE); + strncpy(z_error_message->value.str.val, va_arg(format, char *), ZEND_ERROR_BUFFER_SIZE); + z_error_message->value.str.val[ZEND_ERROR_BUFFER_SIZE - 1] = '\0'; + z_error_message->value.str.len = strlen(z_error_message->value.str.val); /* This is risky... */ /* z_error_message->value.str.len = vsprintf(z_error_message->value.str.val, format, args); */ #endif @@ -778,7 +781,8 @@ z_context->value.ht = EG(active_symbol_table); z_context->type = IS_ARRAY; - ZVAL_ADDREF(z_context); /* we don't want this one to be freed */ + z_context->is_ref = 1; + z_context->refcount = 2; /* we don't want this one to be freed */ params = (zval ***) emalloc(sizeof(zval **)*5); params[0] = &z_error_type;