Bug #71752 [Opn->Csd]: Several places in Zend code where invalid pointers can be dereferenced

From: Date: Thu, 10 Mar 2016 07:03:41 +0000
Subject: Bug #71752 [Opn->Csd]: Several places in Zend code where invalid pointers can be dereferenced
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-199723@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=71752&edit=1

 ID:                 71752
 Updated by:         laruence@php.net
 Reported by:        temp at temp dot ru
 Summary:            Several places in Zend code where invalid pointers
                     can be dereferenced
-Status:             Open
+Status:             Closed
 Type:               Bug
 Package:            *General Issues
 PHP Version:        7.0.4
 Block user comment: N
 Private report:     N

 New Comment:

Automatic comment on behalf of laruence@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=7d5f71b0b125c89211e5a2a6d925deba938abd41
Log: tsrm_win32_get_path_sid_key might returns NULL (Partially fix bug #71752)


Previous Comments:
------------------------------------------------------------------------
[2016-03-09 11:25:19] temp at temp dot ru

Description:
------------
There're several places in Zend code where invalid (zero) pointers can be dereferenced.


1. zend_execute_API.c, zend_call_function function:

if (error) {
	zend_error(E_WARNING, "Invalid callback %s, %s", ZSTR_VAL(callable_name), error); //
<-- Access to callable_name->val
	efree(error);
}
if (callable_name) { // <-- later check if callable_name is not NULL
	zend_string_release(callable_name);
}



2. zend_execute_API.c, zend_call_function function (again):

if (func->common.fn_flags & ZEND_ACC_ABSTRACT) {
	zend_throw_error(NULL, "Cannot call abstract method %s::%s()",
ZSTR_VAL(func->common.scope->name), ZSTR_VAL(func->common.function_name)); // <-- Access
to func->common.scope->name
	return FAILURE;
}
if (func->common.fn_flags & ZEND_ACC_DEPRECATED) {
	zend_error(E_DEPRECATED, "Function %s%s%s() is deprecated",
		func->common.scope ? ZSTR_VAL(func->common.scope->name) : "", // <-- Later
check if func->common.scope is not NULL
		func->common.scope ? "::" : "",
		ZSTR_VAL(func->common.function_name));
}



3. zend_virtual_cwd.c, realpath_cache_key function:

const char *e = bucket_key + strlen(bucket_key); // <-- Access to bucket_key buffer

if (!bucket_key) { // <-- Later check if bucket_key is not NULL
	return 0;
}



------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=71752&edit=1

Thread (3 messages)

« previous php.bugs (#199723) next »