Bug #71752 [Csd]: Several places in Zend code where invalid pointers can be dereferenced

Edit report at https://bugs.php.net/bug.php?id=71752&edit=1 ID: 71752 User updated by: dragondreamer at live dot com Reported by: dragondreamer at live dot com Summary: Several places in Zend code where invalid pointers can be dereferenced Status: Closed Type: Bug Package: *General Issues PHP Version: 7.0.4 Block user comment: N Private report: N New Comment: Edit e-mail address Previous Comments: ------------------------------------------------------------------------ [2016-07-20 11:33:08] davey@php.net Automatic comment on behalf of laruence@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=7d5f71b0b125c89211e5a2a6d925deba938abd41 Log: tsrm_win32_get_path_sid_key might returns NULL (Partially fix bug #71752) ------------------------------------------------------------------------ [2016-03-10 08:36:58] ab@php.net Automatic comment on behalf of laruence@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=67f0770036f866f6f0dadc044cdc8f94a5b9f030 Log: tsrm_win32_get_path_sid_key might returns NULL (Partially fix bug #71752) ------------------------------------------------------------------------ [2016-03-10 07:03:39] laruence@php.net Automatic comment on behalf of laruence@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=7d5f71b0b125c89211e5a2a6d925deba938abd41 Log: tsrm_win32_get_path_sid_key might returns NULL (Partially fix bug #71752) ------------------------------------------------------------------------ [2016-03-09 11:25:19] dragondreamer at live dot com Description: ------------ There're several places in Zend code where invalid (zero) pointers can be dereferenced. 1. zend_execute_API.c, zend_call_function function: if (error) { zend_error(E_WARNING, "Invalid callback %s, %s", ZSTR_VAL(callable_name), error); // <-- Access to callable_name->val efree(error); } if (callable_name) { // <-- later check if callable_name is not NULL zend_string_release(callable_name); } 2. zend_execute_API.c, zend_call_function function (again): if (func->common.fn_flags & ZEND_ACC_ABSTRACT) { zend_throw_error(NULL, "Cannot call abstract method %s::%s()", ZSTR_VAL(func->common.scope->name), ZSTR_VAL(func->common.function_name)); // <-- Access to func->common.scope->name return FAILURE; } if (func->common.fn_flags & ZEND_ACC_DEPRECATED) { zend_error(E_DEPRECATED, "Function %s%s%s() is deprecated", func->common.scope ? ZSTR_VAL(func->common.scope->name) : "", // <-- Later check if func->common.scope is not NULL func->common.scope ? "::" : "", ZSTR_VAL(func->common.function_name)); } 3. zend_virtual_cwd.c, realpath_cache_key function: const char *e = bucket_key + strlen(bucket_key); // <-- Access to bucket_key buffer if (!bucket_key) { // <-- Later check if bucket_key is not NULL return 0; } ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71752&edit=1