Skip to content

Commit 234df40

Browse files
committed
Fix assertion failure in zlib option parsing
1 parent d8a5aec commit 234df40

2 files changed

Lines changed: 29 additions & 0 deletions

File tree

ext/zlib/tests/gh22142.phpt

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
--TEST--
2+
GH-22142: deflate_init() handles undefined variable without assertion failure
3+
--FILE--
4+
<?php
5+
6+
try {
7+
$cls = new LibXMLError();
8+
deflate_init($fusion, $cls);
9+
} catch (\Throwable $e) {
10+
echo $e::class, ": ", $e->getMessage(), "\n";
11+
}
12+
13+
?>
14+
--EXPECTF--
15+
Warning: Undefined variable $fusion in %s on line %d
16+
17+
Deprecated: deflate_init(): Passing null to parameter #1 ($encoding) of type int is deprecated in %s on line %d
18+
TypeError: deflate_init(): Argument #2 ($options) the value for option "level" must be of type int, null given

ext/zlib/zlib.c

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -865,6 +865,17 @@ ZEND_ATTRIBUTE_NONNULL static bool zlib_get_long_option(HashTable *options, cons
865865

866866
/* The |H ZPP specifier may leave HashTable entries wrapped in IS_INDIRECT. */
867867
ZVAL_DEINDIRECT(option_buffer);
868+
if (UNEXPECTED(Z_TYPE_P(option_buffer) == IS_UNDEF)) {
869+
zend_argument_type_error(
870+
2,
871+
"the value for option \"%.*s\" must be of type int, %s given",
872+
(int) option_name_len,
873+
option_name,
874+
zend_zval_value_name(option_buffer)
875+
);
876+
return false;
877+
}
878+
868879
*value = zval_try_get_long(option_buffer, &failed);
869880
if (UNEXPECTED(failed)) {
870881
zend_argument_type_error(

0 commit comments

Comments
 (0)