#38649 [NEW]: NULL pointer leads to core dump in "php_stream_bucket_unlink()"

From: songmaqd at hotmail dot com Operating system: UNIX PHP version: 5CVS-2006-08-30 (snap) PHP Bug Type: Streams related Bug description: NULL pointer leads to core dump in "php_stream_bucket_unlink()" Description: ------------ In source file "main/streams/xp_socket.c", function "sock_sendto" need more strict condition evaluation in "if" judgement. The reason is because PHP function "stream_socket_sendto" has an optional parameter "string address". When user omit this option, "addr" and "addrlen" is not initialized or valid. Since "addr" is a char pointer, if it is not initialized then its value is highly operation system dependent. We can not assume it is "NULL" or a invalid value not not "NULL". This leads core dump. Problem code: static inline int sock_sendto(php_netstream_data_t *sock, char *buf, size_t buflen, int flags, struct sockaddr *addr, socklen_t addrlen TSRMLS_DC) { if (addr) { return sendto(sock->socket, buf, buflen, flags, addr, addrlen); } return send(sock->socket, buf, buflen, flags); } An possible fix example: static inline int sock_sendto(php_netstream_data_t *sock, char *buf, size_t buflen, int flags, struct sockaddr *addr, socklen_t addrlen TSRMLS_DC) { if (addr && (addrlen>0)) /*newly added*/{ return sendto(sock->socket, buf, buflen, flags, addr, addrlen); } return send(sock->socket, buf, buflen, flags); } -- Edit bug report at http://bugs.php.net/?id=38649&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=38649&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=38649&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=38649&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=38649&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=38649&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=38649&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=38649&r=needscript Try newer version: http://bugs.php.net/fix.php?id=38649&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=38649&r=support Expected behavior: http://bugs.php.net/fix.php?id=38649&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=38649&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=38649&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=38649&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=38649&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=38649&r=dst IIS Stability: http://bugs.php.net/fix.php?id=38649&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=38649&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=38649&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=38649&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=38649&r=mysqlcfg