Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:80623 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 55915 invoked from network); 16 Jan 2015 08:14:35 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 16 Jan 2015 08:14:35 -0000 Authentication-Results: pb1.pair.com header.from=git@internot.info; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=git@internot.info; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain internot.info designates 185.57.82.47 as permitted sender) X-PHP-List-Original-Sender: git@internot.info X-Host-Fingerprint: 185.57.82.47 mail.internot.info Received: from [185.57.82.47] ([185.57.82.47:59028] helo=mail.internot.info) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 9D/23-39838-A68C8B45 for ; Fri, 16 Jan 2015 03:14:35 -0500 To: internals@lists.php.net Cc: Joshua Rogers Date: Fri, 16 Jan 2015 19:14:20 +1100 Message-ID: <1421396060-13451-1-git-send-email-git@internot.info> Subject: [PATCH] Fix null pointer dereference(s) -- From: git@internot.info (Joshua Rogers) Multiple places 'spprintf' is called with a NULL 'pbuf', which passes itself to vspprintf, which dereferences it. Although most places check whether 'pbuf'(normally called 'error') is null, it is smarter to check it inside the function that requires a non-null value. This will avoid future problems, too. See bug #68839 [https://bugs.php.net/bug.php?id=68839] for an example of NULL being passed to spprintf. There are multiple other places checks are not used to confirm error/pbuf is not null. --- main/spprintf.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/main/spprintf.c b/main/spprintf.c index cd14882..faa97d1 100644 --- a/main/spprintf.c +++ b/main/spprintf.c @@ -848,11 +848,16 @@ PHPAPI size_t vspprintf(char **pbuf, size_t max_len, const char *format, va_list smart_string_0(&buf); + //Test 'pbuf'(also known as 'error') against NULL, since it is called multiple places without checking against, causing null pointer dereferences. if (buf.c) { - *pbuf = buf.c; + if(pbuf) { + *pbuf = buf.c; + } result = buf.len; } else { - *pbuf = NULL; + if(pbuf) { + *pbuf = NULL; + } result = 0; } -- 1.9.1