Fixed bug #75193 segfault in collator_convert_object_to_string

php · Sep 12, 2017 · b09497c · b09497c
1 parent 5cf2155
commit b09497c
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 2 deletions.
diff --git a/ext/intl/collator/collator_sort.c b/ext/intl/collator/collator_sort.c
@@ -59,8 +59,12 @@ static int collator_regular_compare_function(zval *result, zval *op1, zval *op2)
 	zval norm1, norm2;
 	zval *num1_p = NULL, *num2_p = NULL;
 	zval *norm1_p = NULL, *norm2_p = NULL;
-	zval* str1_p  = collator_convert_object_to_string( op1, &str1 );
-	zval* str2_p  = collator_convert_object_to_string( op2, &str2 );
+	zval *str1_p, *str2_p;
+
+	ZVAL_NULL(&str1);
+	str1_p  = collator_convert_object_to_string( op1, &str1 );
+	ZVAL_NULL(&str2);
+	str2_p  = collator_convert_object_to_string( op2, &str2 );
 
 	/* If both args are strings AND either of args is not numeric string
 	 * then use ICU-compare. Otherwise PHP-compare. */

diff --git a/ext/intl/tests/bug75193.phpt b/ext/intl/tests/bug75193.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #75193 segfault in collator_convert_object_to_string
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+$a = new \Collator('en_US');
+$b = [new stdclass, new stdclass];
+var_dump($a->sort($b));
+?>
+===DONE===
+--EXPECT--
+bool(true)
+===DONE===