[PATCH] ext/bz2/bz2.c - fix mem overrun in _php_stream_bz2open in ZTS mode
| From: | Markus Fischer | Date: | Fri, 31 May 2002 21:32:14 +0000 |
| Subject: | [PATCH] ext/bz2/bz2.c - fix mem overrun in _php_stream_bz2open in ZTS mode | ||
| Groups: | php.dev | ||
| Request: | Send a blank email to php-dev+get-84640@lists.php.net to get a copy of this message | ||
Hi,
There's a problem with path_copy and ZTS mode (which defines
VIRTUAL_DIR). It's estrdup()d only in non-ZTS mode but also
efree() in ZTS mode which causes problem.
The patch fixed that, but me being not that familiar with the
things, I better let commit this someone who knows the code
(Wez, Sterling?).
- Markus
--
GnuPG Key: http://guru.josefine.at/~mfischer/C2272BD0.asc
Wishlist: http://guru.josefine.at/~mfischer/wishlist
? bz2-fix-overrun.diff Index: bz2.c =================================================================== RCS file: /repository/php4/ext/bz2/bz2.c,v retrieving revision 1.49 diff -u -r1.49 bz2.c --- bz2.c 19 Apr 2002 10:06:41 -0000 1.49 +++ bz2.c 31 May 2002 21:25:10 -0000 @@ -170,18 +170,15 @@ #ifdef VIRTUAL_DIR virtual_filepath(path, &path_copy TSRMLS_CC); #else - path_copy = estrdup(path); + path_copy = path; #endif /* try and open it directly first */ bz_file = BZ2_bzopen(path_copy, mode); - if (opened_path == NULL) { - efree(path_copy); - } else if (bz_file) { - *opened_path = path_copy; + if (bz_file && opened_path != NULL) { + *opened_path = estrdup(path_copy); } - path_copy = NULL; if (bz_file == NULL) { /* that didn't work, so try and get something from the network/wrapper */
? bz2-fix-overrun.diff Index: bz2.c =================================================================== RCS file: /repository/php4/ext/bz2/bz2.c,v retrieving revision 1.49 diff -u -r1.49 bz2.c --- bz2.c 19 Apr 2002 10:06:41 -0000 1.49 +++ bz2.c 31 May 2002 21:25:10 -0000 @@ -170,18 +170,15 @@ #ifdef VIRTUAL_DIR virtual_filepath(path, &path_copy TSRMLS_CC); #else - path_copy = estrdup(path); + path_copy = path; #endif /* try and open it directly first */ bz_file = BZ2_bzopen(path_copy, mode); - if (opened_path == NULL) { - efree(path_copy); - } else if (bz_file) { - *opened_path = path_copy; + if (bz_file && opened_path != NULL) { + *opened_path = estrdup(path_copy); } - path_copy = NULL; if (bz_file == NULL) { /* that didn't work, so try and get something from the network/wrapper */