Skip to content

Commit af41914

Browse files
committed
fix #66872, invalid argument crashes gmp_testbit
1 parent cedc718 commit af41914

File tree

1 file changed

+7
-9
lines changed

1 file changed

+7
-9
lines changed

ext/gmp/gmp.c

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1511,25 +1511,23 @@ ZEND_FUNCTION(gmp_clrbit)
15111511
Tests if bit is set in a */
15121512
ZEND_FUNCTION(gmp_testbit)
15131513
{
1514-
zval **a_arg;
1514+
zval *a_arg;
15151515
long index;
1516-
mpz_t *gmpnum_a;
1516+
mpz_ptr gmpnum_a;
1517+
gmp_temp_t temp_a;
15171518

1518-
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Zl", &a_arg, &index) == FAILURE){
1519+
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zl", &a_arg, &index) == FAILURE){
15191520
return;
15201521
}
15211522

1522-
ZEND_FETCH_RESOURCE(gmpnum_a, mpz_t *, a_arg, -1, GMP_RESOURCE_NAME, le_gmp);
1523-
15241523
if (index < 0) {
15251524
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Index must be greater than or equal to zero");
15261525
RETURN_FALSE;
15271526
}
15281527

1529-
if (mpz_tstbit(*gmpnum_a, index)) {
1530-
RETURN_TRUE;
1531-
}
1532-
RETURN_FALSE;
1528+
FETCH_GMP_ZVAL(gmpnum_a, a_arg, temp_a);
1529+
RETVAL_BOOL(mpz_tstbit(gmpnum_a, index));
1530+
FREE_GMP_TEMP(temp_a);
15331531
}
15341532
/* }}} */
15351533

0 commit comments

Comments
 (0)