cvs: ZendEngine2(PHP_5_2) / zend_execute_API.c

dmitry		Thu Jan 15 14:23:42 2009 UTC

  Modified files:              (Branch: PHP_5_2)
    /ZendEngine2	zend_execute_API.c 
  Log:
  Fixed possible crash because of argument stack reallocation
  
  
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_execute_API.c?r1=1.331.2.20.2.29&r2=1.331.2.20.2.30&diff_format=u
Index: ZendEngine2/zend_execute_API.c
diff -u ZendEngine2/zend_execute_API.c:1.331.2.20.2.29 ZendEngine2/zend_execute_API.c:1.331.2.20.2.30
--- ZendEngine2/zend_execute_API.c:1.331.2.20.2.29	Wed Dec 31 11:17:33 2008
+++ ZendEngine2/zend_execute_API.c	Thu Jan 15 14:23:42 2009
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_execute_API.c,v 1.331.2.20.2.29 2008/12/31 11:17:33 sebastian Exp $ */
+/* $Id: zend_execute_API.c,v 1.331.2.20.2.30 2009/01/15 14:23:42 dmitry Exp $ */
 
 #include <stdio.h>
 #include <signal.h>
@@ -901,6 +901,26 @@
 		}
 	}
 
+	/* Prevent crash because of stack reallocation */
+	if (!call_via_handler &&
+	    fci->param_count &&
+	    EG(argument_stack).top + fci->param_count > EG(argument_stack).max &&
+	    *(void***)fci->params >= EG(argument_stack).elements &&
+	    *(void***)fci->params < EG(argument_stack).top_element) {
+
+		/* Manual stack reallocation */
+		void **prev_elements = EG(argument_stack).elements;
+		void **prev_top_element = EG(argument_stack).top_element;
+
+		ZEND_PTR_STACK_RESIZE_IF_NEEDED((&EG(argument_stack)), fci->param_count);
+		for (i=0; i<fci->param_count; i++) {
+			if ((void**)fci->params[i] >= prev_elements &&
+			    (void**)fci->params[i] < prev_top_element) {
+				fci->params[i] = (zval**)((void**)fci->params[i] - prev_elements + EG(argument_stack).elements);
+			}
+		}
+	}
+
 	for (i=0; i<fci->param_count; i++) {
 		zval *param;