Merge branch 'PHP-7.2' into PHP-7.3

* PHP-7.2: Fixed bug #77395 (segfault about array_multisort)
php · Jan 2, 2019 · e527626 · e527626
2 parents 6f663c3 + 8ebae84
commit e527626
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 4 deletions.
diff --git a/ext/standard/array.c b/ext/standard/array.c
@@ -5572,7 +5572,7 @@ PHPAPI int php_multisort_compare(const void *a, const void *b) /* {{{ */
 /* }}} */
 
 #define MULTISORT_ABORT				\
-	efree(ARRAYG(multisort_func));	\
+	efree(func);	\
 	efree(arrays);					\
 	RETURN_FALSE;
 
@@ -5604,6 +5604,7 @@ PHP_FUNCTION(array_multisort)
 	int				sort_order = PHP_SORT_ASC;
 	int				sort_type  = PHP_SORT_REGULAR;
 	int				i, k, n;
+	compare_func_t  *func;
 
 	ZEND_PARSE_PARAMETERS_START(1, -1)
 		Z_PARAM_VARIADIC('+', args, argc)
@@ -5614,7 +5615,7 @@ PHP_FUNCTION(array_multisort)
 	for (i = 0; i < MULTISORT_LAST; i++) {
 		parse_state[i] = 0;
 	}
-	ARRAYG(multisort_func) = (compare_func_t*)ecalloc(argc, sizeof(compare_func_t));
+	func = ARRAYG(multisort_func) = (compare_func_t*)ecalloc(argc, sizeof(compare_func_t));
 
 	/* Here we go through the input arguments and parse them. Each one can
 	 * be either an array or a sort flag which follows an array. If not
@@ -5698,7 +5699,7 @@ PHP_FUNCTION(array_multisort)
 
 	/* If all arrays are empty we don't need to do anything. */
 	if (array_size < 1) {
-		efree(ARRAYG(multisort_func));
+		efree(func);
 		efree(arrays);
 		RETURN_TRUE;
 	}
@@ -5757,7 +5758,7 @@ PHP_FUNCTION(array_multisort)
 		efree(indirect[i]);
 	}
 	efree(indirect);
-	efree(ARRAYG(multisort_func));
+	efree(func);
 	efree(arrays);
 	RETURN_TRUE;
 }

diff --git a/ext/standard/tests/array/bug77395.phpt b/ext/standard/tests/array/bug77395.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #77395 (segfault about array_multisort)
+--FILE--
+<?php
+function error_handle($level, $message, $file = '', $line = 0){
+	$a = [1,2,3];
+	$b = [3,2,1];
+	echo $message;
+	array_multisort($a, SORT_ASC, $b); // if comment this line, no segfault happen
+}
+set_error_handler('error_handle');
+$data = [['aa'=> 'bb',], ['aa'=> 'bb',],];
+array_multisort(array_column($data, 'bb'),SORT_DESC, $data); // PHP Warning error 
+?>
+--EXPECT--
+array_multisort(): Array sizes are inconsistent