Bug #69619 [NEW]: wrong argument for memcpy in from_zval_write_control

From: Date: Mon, 11 May 2015 07:19:27 +0000
Subject: Bug #69619 [NEW]: wrong argument for memcpy in from_zval_write_control
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-192614@lists.php.net to get a copy of this message 
From:             herumi at nifty dot com
Operating system: all
PHP version:      5.5.24
Package:          Sockets related
Bug Type:         Bug
Bug description:wrong argument for memcpy in from_zval_write_control

Description:
------------
The code ext/sockets/conversion.c:914 in php-5.5.24

if (space_left < req_space) {
    *control_buf = safe_erealloc(*control_buf, 2, req_space,
*control_len);
    *control_len += 2 * req_space;
    memset(*control_buf, '\0', *control_len - *offset);      // (A)
    memcpy(&alloc->data, *control_buf, sizeof *control_buf); // (B)
}

Maybe th code (B) fill alloc->data with 8-byte zeros
because (A) fills *control_buf with zeros,
then the value of *control_buf is lost.

cf.
https://github.com/php/php-src/blob/master/ext/sockets/conversions.c#L893

Is the correct code as the following?
memcpy(&alloc->data, control_buf, sizeof *control_buf);




-- 
Edit bug report at https://bugs.php.net/bug.php?id=69619&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=69619&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=69619&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=69619&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=69619&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=69619&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=69619&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=69619&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=69619&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=69619&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=69619&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=69619&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=69619&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=69619&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69619&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=69619&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=69619&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=69619&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=69619&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=69619&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=69619&r=mysqlcfg

Thread (8 messages)

« previous php.bugs (#192614) next »