Bug #71752 [NEW]: Several places in Zend code where invalid pointers can be dereferenced
From: temp at temp dot ru
Operating system:
PHP version: 7.0.4
Package: *General Issues
Bug Type: Bug
Bug description:Several places in Zend code where invalid pointers can be dereferenced
Description:
------------
There're several places in Zend code where invalid (zero) pointers can
be dereferenced.
1. zend_execute_API.c, zend_call_function function:
if (error) {
zend_error(E_WARNING, "Invalid callback %s, %s",
ZSTR_VAL(callable_name), error); // <-- Access to callable_name->val
efree(error);
}
if (callable_name) { // <-- later check if callable_name is not NULL
zend_string_release(callable_name);
}
2. zend_execute_API.c, zend_call_function function (again):
if (func->common.fn_flags & ZEND_ACC_ABSTRACT) {
zend_throw_error(NULL, "Cannot call abstract method %s::%s()",
ZSTR_VAL(func->common.scope->name),
ZSTR_VAL(func->common.function_name)); // <-- Access to
func->common.scope->name
return FAILURE;
}
if (func->common.fn_flags & ZEND_ACC_DEPRECATED) {
zend_error(E_DEPRECATED, "Function %s%s%s() is deprecated",
func->common.scope ? ZSTR_VAL(func->common.scope->name) : "", // <--
Later check if func->common.scope is not NULL
func->common.scope ? "::" : "",
ZSTR_VAL(func->common.function_name));
}
3. zend_virtual_cwd.c, realpath_cache_key function:
const char *e = bucket_key + strlen(bucket_key); // <-- Access to
bucket_key buffer
if (!bucket_key) { // <-- Later check if bucket_key is not NULL
return 0;
}
--
Edit bug report at https://bugs.php.net/bug.php?id=71752&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71752&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71752&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71752&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=71752&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=71752&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=71752&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=71752&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=71752&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=71752&r=support
Expected behavior: https://bugs.php.net/fix.php?id=71752&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=71752&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=71752&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=71752&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71752&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=71752&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=71752&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=71752&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=71752&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=71752&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=71752&r=mysqlcfg
Thread (3 messages)
- temp at temp dot ru