colder		Sun Oct  5 14:49:26 2008 UTC

  Added files:                 (Branch: PHP_5_2)
    /php-src/ext/spl/tests	array_026.phpt 

  Modified files:              
    /php-src	NEWS 
    /php-src/ext/spl	spl_array.c 
  Log:
  Fix #46222 (Allow indirect modifications of Arrays inside ArrayObject + fix EG(uninitialized_zval_ptr) overwrite)
  
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1241&r2=1.2027.2.547.2.1242&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.547.2.1241 php-src/NEWS:1.2027.2.547.2.1242
--- php-src/NEWS:1.2027.2.547.2.1241	Sun Oct  5 01:40:38 2008
+++ php-src/NEWS	Sun Oct  5 14:49:25 2008
@@ -141,6 +141,8 @@
 - Fixed bug #42318 (problem with nm on AIX, not finding object files). (Dmitry)
 - Fixed bug #41348 (OCI8: allow compilation with Oracle 8.1). (Chris Jones)
 - Fixed bug #14032 (Mail() always returns false but mail is sent). (Mikko)
+- Fixed bug #46222 (ArrayObject EG(uninitialized_var_ptr) overwrite).
+  (Etienne)
 
 01 May 2008, PHP 5.2.6
 - Fixed two possible crashes inside posix extension (Tony)
http://cvs.php.net/viewvc.cgi/php-src/ext/spl/spl_array.c?r1=1.71.2.17.2.16&r2=1.71.2.17.2.17&diff_format=u
Index: php-src/ext/spl/spl_array.c
diff -u php-src/ext/spl/spl_array.c:1.71.2.17.2.16 php-src/ext/spl/spl_array.c:1.71.2.17.2.17
--- php-src/ext/spl/spl_array.c:1.71.2.17.2.16	Mon Jul  7 00:02:22 2008
+++ php-src/ext/spl/spl_array.c	Sun Oct  5 14:49:25 2008
@@ -16,7 +16,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: spl_array.c,v 1.71.2.17.2.16 2008/07/07 00:02:22 colder Exp $ */
+/* $Id: spl_array.c,v 1.71.2.17.2.17 2008/10/05 14:49:25 colder Exp $ */
 
 #ifdef HAVE_CONFIG_H
 # include "config.h"
@@ -255,6 +255,7 @@
 	spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
 	zval **retval;
 	long index;
+	HashTable *ht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
 
 /*  We cannot get the pointer pointer so we don't allow it here for now
 	if (check_inherited && intern->fptr_offset_get) {
@@ -267,9 +268,17 @@
 	
 	switch(Z_TYPE_P(offset)) {
 	case IS_STRING:
-		if (zend_symtable_find(spl_array_get_hash_table(intern, 0 TSRMLS_CC), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, (void **) &retval) == FAILURE) {
-			zend_error(E_NOTICE, "Undefined index:  %s", Z_STRVAL_P(offset));
-			return &EG(uninitialized_zval_ptr);
+		if (zend_symtable_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, (void **) &retval) == FAILURE) {
+			if (type == BP_VAR_W || type == BP_VAR_RW) {
+				zval *value;
+				ALLOC_INIT_ZVAL(value);
+				zend_symtable_update(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, (void**)&value, sizeof(void*), NULL);
+				zend_symtable_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, (void **) &retval);
+				return retval;
+			} else {
+				zend_error(E_NOTICE, "Undefined index:  %s", Z_STRVAL_P(offset));
+				return &EG(uninitialized_zval_ptr);
+			}
 		} else {
 			return retval;
 		}
@@ -282,9 +291,17 @@
 		} else {
 			index = Z_LVAL_P(offset);
 		}
-		if (zend_hash_index_find(spl_array_get_hash_table(intern, 0 TSRMLS_CC), index, (void **) &retval) == FAILURE) {
-			zend_error(E_NOTICE, "Undefined offset:  %ld", Z_LVAL_P(offset));
-			return &EG(uninitialized_zval_ptr);
+		if (zend_hash_index_find(ht, index, (void **) &retval) == FAILURE) {
+			if (type == BP_VAR_W || type == BP_VAR_RW) {
+				zval *value;
+				ALLOC_INIT_ZVAL(value);
+				zend_hash_index_update(ht, index, (void**)&value, sizeof(void*), NULL);
+				zend_hash_index_find(ht, index, (void **) &retval);
+				return retval;
+			} else {
+				zend_error(E_NOTICE, "Undefined offset:  %ld", Z_LVAL_P(offset));
+				return &EG(uninitialized_zval_ptr);
+			}
 		} else {
 			return retval;
 		}

http://cvs.php.net/viewvc.cgi/php-src/ext/spl/tests/array_026.phpt?view=markup&rev=1.1
Index: php-src/ext/spl/tests/array_026.phpt
+++ php-src/ext/spl/tests/array_026.phpt
--TEST--
SPL: ArrayObject indirect offsetGet overwriting EG(uninitialized_zvar_ptr)
--FILE--
<?php
$test = new ArrayObject();
$test['d1']['d2'] = 'hello';
$test['d1']['d3'] = 'world';
var_dump($test, $test3['mmmmm']);
?>
--EXPECTF--
Notice: Undefined variable: test3 in %s%earray_026.php on line 5
object(ArrayObject)#%d (1) {
  [u"storage":u"ArrayObject":private]=>
  array(1) {
    [u"d1"]=>
    array(2) {
      [u"d2"]=>
      unicode(5) "hello"
      [u"d3"]=>
      unicode(5) "world"
    }
  }
}
NULL