[php-src] PR #23456: Fix GH-23453: bad free with a context engine ID longer than 32 bytes
| From: | lazerg | Date: | Tue, 25 Aug 2026 16:22:32 +0000 |
| Subject: | [php-src] PR #23456: Fix GH-23453: bad free with a context engine ID longer than 32 bytes | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38136@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23456
Author: lazerg
netsnmp_session_set_contextEngineID() passes an emalloc()'d buffer to
snmp_hex_to_binary() with allow_realloc set. A context engine ID longer
than the 32-byte buffer makes net-snmp call snmp_realloc() on that pointer, which
aborts the process.
RFC 3411 caps the engine ID at 32 bytes anyway, so this drops allow_realloc: an
oversized value now hits the existing "Bad engine ID value" warning and returns false.
Fixes GH-23453.