[php-src] PR #25205: Copy the context name in SNMP::setSecurity()
| From: | lacatoire | Date: | Thu, 05 Nov 2026 12:56:50 +0000 |
| Subject: | [php-src] PR #25205: Copy the context name in SNMP::setSecurity() | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40319@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25205
Author: lacatoire
SNMP::setSecurity() stored a pointer into the $contextName string instead
of copying it, so the next request read freed memory once the string was released. Copy it and free
it with the session.
### To reproduce
```php
<?php
$s = new SNMP(SNMP::VERSION_3, '127.0.0.1', 'adminMD5AES', 500000, 1);
$ctx = str_repeat('c', 5) . random_int(10, 99);
$s->setSecurity('authPriv', 'MD5', 'test1234', 'AES',
'test1234', $ctx);
unset($ctx);
var_dump(@$s->get('.1.3.6.1.2.1.1.4.0'));
```
Before (ASAN build): heap-use-after-free in strdup, called from
snmp_sess_add_ex
After: bool(false)