Skip to content

Commit

Permalink
Fixed bug #73679 DOTNET read access violation using invalid codepage
Browse files Browse the repository at this point in the history
  • Loading branch information
weltling committed Dec 11, 2016
1 parent 66ad791 commit 1d80fb2
Show file tree
Hide file tree
Showing 2 changed files with 28 additions and 1 deletion.
9 changes: 8 additions & 1 deletion ext/com_dotnet/com_dotnet.c
Expand Up @@ -196,6 +196,7 @@ PHP_FUNCTION(com_dotnet_create_instance)
int ret = FAILURE;
char *where = "";
IUnknown *unk = NULL;
zend_long cp = CP_ACP;

php_com_initialize();
stuff = (struct dotnet_runtime_stuff*)COMG(dotnet_runtime_stuff);
Expand Down Expand Up @@ -245,11 +246,17 @@ PHP_FUNCTION(com_dotnet_create_instance)
if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS(), "ss|l",
&assembly_name, &assembly_name_len,
&datatype_name, &datatype_name_len,
&obj->code_page)) {
&cp)) {
php_com_throw_exception(E_INVALIDARG, "Could not create .Net object - invalid arguments!");
return;
}

if (Z_L(0) > cp || ZEND_LONG_INT_OVFL(cp)) {
php_com_throw_exception(E_INVALIDARG, "Could not create .Net object - invalid codepage!");
return;
}
obj->code_page = (int)cp;

oletype = php_com_string_to_olestring(datatype_name, datatype_name_len, obj->code_page);
oleassembly = php_com_string_to_olestring(assembly_name, assembly_name_len, obj->code_page);
oletype_sys = SysAllocString(oletype);
Expand Down
20 changes: 20 additions & 0 deletions ext/com_dotnet/tests/bug73679.phpt
@@ -0,0 +1,20 @@
--TEST--
Bug #73679 DOTNET read access violation using invalid codepage
--SKIPIF--
<?php # vim:ft=php
if (!extension_loaded("com_dotnet")) print "skip COM/.Net support not present"; ?>
--FILE--
<?php

$stack = new DOTNET("mscorlib", "System.Collections.Stack", -2200000000);
$stack->Push(".Net");
$stack->Push("Hello ");
echo $stack->Pop() . $stack->Pop();

?>
--EXPECTF--
Fatal error: Uncaught com_exception: Could not create .Net object - invalid codepage! in %sbug73679.php:%d
Stack trace:
#0 %sbug73679.php(%d): dotnet->dotnet('mscorlib', 'System.Collecti...', -2200000000)
#1 {main}
thrown in %sbug73679.php on line %d

0 comments on commit 1d80fb2

Please sign in to comment.