[php-src] Issue #15628: php_stream_memory_get_buffer returns a zend_string which is not zero-terminated

From: Date: Wed, 28 Aug 2024 23:52:19 +0000
Subject: [php-src] Issue #15628: php_stream_memory_get_buffer returns a zend_string which is not zero-terminated
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-247624@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/15628 Author: cmb69 ### Description The [documentation of zend_strings](https://www.phpinternalsbook.com/php7/internal_types/strings/zend_strings.html) states: > It should be noted that while len stores the length without a trailing null byte, the actual > string contents in val must always contain a trailing null byte. According to this, https://github.com/php/pecl-mail-mailparse/commit/36807106310ceeade795a3091dfff3a6a4564c28 has been commited a while ago. However, that caused an issue which had been reported as https://github.com/php/pecl-mail-mailparse/issues/31. The problem here is that php_stream_memory_get_buffer returns a zend_string which is not zero-terminated. Now, the question is whether that is a bug in php_stream_memory_get_buffer(), or whether zend_strings are always zero-terminated, unless they aren't. A possible fix for php_stream_memory_get_buffer() might be: ````diff main/streams/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main/streams/memory.c b/main/streams/memory.c index f53084a6c3a..be8223fc72a 100644 --- a/main/streams/memory.c +++ b/main/streams/memory.c @@ -321,7 +321,7 @@ PHPAPI zend_string *_php_stream_memory_get_buffer(php_stream *stream STREAMS_DC) { php_stream_memory_data *ms = (php_stream_memory_data*)stream->abstract; ZEND_ASSERT(ms != NULL); - return ms->data; + return zend_string_init_fast(ZSTR_VAL(ms->data), ZSTR_LEN(ms->data)); } /* }}} */ ```` If this is not a bug in php_stream_memory_get_buffer(), an obvious fix for mailparse would be to revert https://github.com/php/pecl-mail-mailparse/commit/36807106310ceeade795a3091dfff3a6a4564c28. ### PHP Version PHP 8.1 ### Operating System any

« previous php.bugs (#247624) next »