THRIFT-349. php: Accelerated binary protocol serialization segementation fault

Check to make sure that the object being serialized has a valid struct spec, error otherwise.

git-svn-id: https://svn.apache.org/repos/asf/incubator/thrift/trunk@773976 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/lib/php/src/ext/thrift_protocol/php_thrift_protocol.cpp b/lib/php/src/ext/thrift_protocol/php_thrift_protocol.cpp
index 76a8a44..6844fb3 100644 (file)
--- a/lib/php/src/ext/thrift_protocol/php_thrift_protocol.cpp
+++ b/lib/php/src/ext/thrift_protocol/php_thrift_protocol.cpp
@@ -716,6 +716,9 @@ void binary_serialize(int8_t thrift_typeID, PHPOutputTransport& transport, zval*
         throw_tprotocolexception("Attempt to send non-object type as a T_STRUCT", INVALID_DATA);
       }
       zval* spec = zend_read_static_property(zend_get_class_entry(*value TSRMLS_CC), "_TSPEC", 6, false TSRMLS_CC);
+      if (Z_TYPE_P(spec) != IS_ARRAY) {
+        throw_tprotocolexception("Attempt to send non-Thrift object as a T_STRUCT", INVALID_DATA);
+      }
       binary_serialize_spec(*value, transport, Z_ARRVAL_P(spec));
     } return;
     case T_BOOL:
@@ -917,6 +920,9 @@ PHP_FUNCTION(thrift_protocol_write_binary) {
     }
 
     zval* spec = zend_read_static_property(zend_get_class_entry(request_struct TSRMLS_CC), "_TSPEC", 6, false TSRMLS_CC);
+    if (Z_TYPE_P(spec) != IS_ARRAY) {
+        throw_tprotocolexception("Attempt to send non-Thrift object", INVALID_DATA);
+    }
     binary_serialize_spec(request_struct, transport, Z_ARRVAL_P(spec));
   } catch (const PHPExceptionWrapper& ex) {
     zend_throw_exception_object(ex TSRMLS_CC);