[php-src] Issue #15628: php_stream_memory_get_buffer returns a zend_string which is not zero-terminated
| From: | cmb69 | Date: | Wed, 28 Aug 2024 23:52:19 +0000 |
| Subject: | [php-src] Issue #15628: php_stream_memory_get_buffer returns a zend_string which is not zero-terminated | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-247624@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/15628
Author: cmb69
### Description
The [documentation of
zend_strings](https://www.phpinternalsbook.com/php7/internal_types/strings/zend_strings.html)
states:
> It should be noted that while len stores the length without a trailing null byte, the actual
> string contents in val must always contain a trailing null byte.
According to this, https://github.com/php/pecl-mail-mailparse/commit/36807106310ceeade795a3091dfff3a6a4564c28
has been commited a while ago. However, that caused an issue which had been reported as https://github.com/php/pecl-mail-mailparse/issues/31.
The problem here is that php_stream_memory_get_buffer returns a
zend_string which is not zero-terminated. Now, the question is whether that is a bug in
php_stream_memory_get_buffer(), or whether zend_strings are always
zero-terminated, unless they aren't.
A possible fix for php_stream_memory_get_buffer() might be:
````diff
main/streams/memory.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/main/streams/memory.c b/main/streams/memory.c
index f53084a6c3a..be8223fc72a 100644
--- a/main/streams/memory.c
+++ b/main/streams/memory.c
@@ -321,7 +321,7 @@ PHPAPI zend_string *_php_stream_memory_get_buffer(php_stream *stream STREAMS_DC)
{
php_stream_memory_data *ms = (php_stream_memory_data*)stream->abstract;
ZEND_ASSERT(ms != NULL);
- return ms->data;
+ return zend_string_init_fast(ZSTR_VAL(ms->data), ZSTR_LEN(ms->data));
}
/* }}} */
````
If this is not a bug in php_stream_memory_get_buffer(), an obvious fix for mailparse
would be to revert https://github.com/php/pecl-mail-mailparse/commit/36807106310ceeade795a3091dfff3a6a4564c28.
### PHP Version
PHP 8.1
### Operating System
any