Sec Bug->Req #68817 [Opn]: Null pointer deference

Edit report at https://bugs.php.net/bug.php?id=68817&edit=1 ID: 68817 Updated by: tony2001@php.net Reported by: bugreports at internot dot info Summary: Null pointer deference Status: Open -Type: Security +Type: Feature/Change Request Package: JSON related Operating System: Linux Ubuntu 14.04 PHP Version: master-Git-2015-01-12 (Git) Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2015-01-14 12:40:15] bugreports at internot dot info Yes. And the if() at line 564 could/should probably be removed, then. Thanks, ------------------------------------------------------------------------ [2015-01-14 09:36:03] tony2001@php.net Because Nikita Popov added it in b30c7fe2 for some reason. Do I understand it correctly that you don't have a reproduce case and just trying to deduce security problem by looking at the code? ------------------------------------------------------------------------ [2015-01-13 17:09:14] bugreports at internot dot info Why is there a check on line 564 then? Thanks, ------------------------------------------------------------------------ [2015-01-13 09:45:35] tony2001@php.net But it is initialized at the top of the func: smart_str buf = {0}; Do you have a reproduce case? ------------------------------------------------------------------------ [2015-01-12 18:49:57] bugreports at internot dot info Description: ------------ Hi, In ext/json/JSON_parser.c: 585 buf.s->len = 0; but it is possible for buf.s to not be initalized. The proper code is demonstrated in the previous "case": 564 if (buf.s) { buf.s->len = 0; } I imagine this can be triggered if "type == IS_STRING" is false. Thanks, ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68817&edit=1