[php-src] Issue #19200: Not checked realloc and malloc result can result in unclean crash
| From: | bukka | Date: | Mon, 21 Jul 2025 11:50:48 +0000 |
| Subject: | [php-src] Issue #19200: Not checked realloc and malloc result can result in unclean crash | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-250467@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/19200
Author: bukka
### Description
This came from the PVC-Studio analyzer report that reported those case for realloc where the
original pointer can be lost in this way:
``` c
ZEND_API void zend_collect_module_handlers(void)
{
....
module_request_startup_handlers = (zend_module_entry**)realloc( // <=
module_request_startup_handlers,
sizeof(zend_module_entry*) *
(startup_count + 1 +
shutdown_count + 1 +
post_deactivate_count + 1));
....
}
```
**Message**: [V701](https://pvs-studio.com/en/docs/warnings/v701/) realloc() possible leak: when
realloc() fails in allocating memory, original pointer 'module_request_startup_handlers'
is lost. Consider assigning realloc() to a temporary pointer.
**Path**: Zend/zend_API.c
**Line**: 2514
<details>
<summary>Other fragments V701</summary>
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'zend_version_info' is lost. Consider assigning realloc() to a temporary pointer. zend.c
1299
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'module_request_startup_handlers' is lost. Consider assigning realloc() to a temporary
pointer. zend_API.c 2514
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'modules_dl_loaded' is lost. Consider assigning realloc() to a temporary pointer.
zend_API.c 2526
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'class_cleanup_handlers' is lost. Consider assigning realloc() to a temporary pointer.
zend_API.c 2553
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'zend_flf_handlers' is lost. Consider assigning realloc() to a temporary pointer.
zend_API.c 3086
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'zend_flf_functions' is lost. Consider assigning realloc() to a temporary pointer.
zend_API.c 3087
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'p' is lost. Consider assigning realloc() to a temporary pointer. zend_alloc.c 3299
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'ce->interfaces' is lost. Consider assigning realloc() to a temporary pointer.
zend_inheritance.c 1576
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'ce->interfaces' is lost. Consider assigning realloc() to a temporary pointer.
zend_inheritance.c 2194
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'q->set' is lost. Consider assigning realloc() to a temporary pointer. ir_private.h 593
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'strtab->buf' is lost. Consider assigning realloc() to a temporary pointer. ir_strtab.c
81
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'blacklist->entries' is lost. Consider assigning realloc() to a temporary pointer.
zend_accelerator_blacklist.c 236
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'* tmphstbuf' is lost. Consider assigning realloc() to a temporary pointer. network.c 1296
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'php_ini_scanned_files' is lost. Consider assigning realloc() to a temporary pointer.
php_ini.c 702
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'b->value' is lost. Consider assigning realloc() to a temporary pointer.
php_ini_builder.h 65
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'zend_extensions' is lost. Consider assigning realloc() to a temporary pointer. phpdbg.c
1216
<br> V701 realloc() possible leak: when realloc() fails in allocating memory, original pointer
'state->code' is lost. Consider assigning realloc() to a temporary pointer.
phpdbg_prompt.c 245
</details>
We have got many more places with malloc where the result is not checked.
The easiest solution would be to use
perealloc and pemalloc which should
cleanly exit.
It's somewhere between a bug and improvement but treating that as a bug would reduce the
conflicts for future fixes and the risk should be quite minimal in this replacement.
### PHP Version
```plain
PHP 8.3
```
### Operating System
_No response_