Skip to content

Commit d991df2

Browse files
committed
Fix #80324: Segfault in YAML with anonymous functions
We must not assume that `key->val` is `sizeof(YAML_TIMESTAMP_TAG)` long or longer. Actually, `zend_string_equals_literal()` (available as of PHP 7.0.0) does exactly what we want.
1 parent 0c81894 commit d991df2

File tree

2 files changed

+26
-1
lines changed

2 files changed

+26
-1
lines changed

tests/bug80324.phpt

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
--TEST--
2+
Bug #80324 (Segfault in YAML with anonymous functions)
3+
--SKIPIF--
4+
<?php if(!extension_loaded('yaml')) die('skip yaml n/a'); ?>
5+
--FILE--
6+
<?php
7+
$yaml = <<<YAML
8+
- !env ENV
9+
- !path PATH
10+
YAML;
11+
12+
$result = yaml_parse($yaml, 0, $ndocs, array(
13+
'!env' => function ($str) {return $str;},
14+
'!path' => function ($str) {return $str;},
15+
));
16+
17+
var_dump($result);
18+
?>
19+
--EXPECT--
20+
array(2) {
21+
[0]=>
22+
string(3) "ENV"
23+
[1]=>
24+
string(4) "PATH"
25+
}

yaml.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -304,7 +304,7 @@ static int php_yaml_check_callbacks(HashTable *callbacks)
304304
zend_string_release(name);
305305
}
306306

307-
if (!memcmp(key->val, YAML_TIMESTAMP_TAG, sizeof(YAML_TIMESTAMP_TAG))) {
307+
if (zend_string_equals_literal(key, YAML_TIMESTAMP_TAG)) {
308308
YAML_G(timestamp_decoder) = entry;
309309
}
310310

0 commit comments

Comments
 (0)