#38648 [Opn->Fbk]: NULL pointer leads to core dump in "php_stream_bucket_unlink()"

ID: 38648 Updated by: tony2001@php.net Reported By: songmaqd at hotmail dot com -Status: Open +Status: Feedback Bug Type: Streams related Operating System: UNIX PHP Version: 5CVS-2006-08-30 (CVS) New Comment: Thank you for this bug report. To properly diagnose the problem, we need a short but complete example script to be able to reproduce this bug ourselves. A proper reproducing script starts with <?php and ends with ?>, is max. 10-20 lines long and does not require any external resources such as databases, etc. If the script requires a database to demonstrate the issue, please make sure it creates all necessary tables, stored procedures etc. Please avoid embedding huge scripts into the report. Previous Comments: ------------------------------------------------------------------------ [2006-08-30 05:49:47] songmaqd at hotmail dot com Description: ------------ In source file "main/streams/filter.c", function "PHPAPI void php_stream_bucket_unlink(php_stream_bucket *bucket TSRMLS_DC) " needs some additional sanity check for NULL pointer of "brigade". Otherwise it leads to core dump if "brigade" is NULL. A possible example for this fix is: PHPAPI void php_stream_bucket_unlink(php_stream_bucket *bucket TSRMLS_DC) { if (bucket->prev) { bucket->prev->next = bucket->next; } else if (bucket->brigade) /*newly added*/{ bucket->brigade->head = bucket->next; } if (bucket->next) { bucket->next->prev = bucket->prev; } else if (bucket->brigade) /*newly added*/{ bucket->brigade->tail = bucket->prev; } bucket->brigade = NULL; bucket->next = bucket->prev = NULL; } ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=38648&edit=1