Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:80624
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.177 as permitted sender)
Message-ID: <54B8CA9F.6050800@gmail.com>
Date: Fri, 16 Jan 2015 00:23:59 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Thunderbird/31.3.0
MIME-Version: 1.0
To: Joshua Rogers <git@internot.info>, internals@lists.php.net
References: <1421396060-13451-1-git-send-email-git@internot.info>
In-Reply-To: <1421396060-13451-1-git-send-email-git@internot.info>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [PATCH] Fix null pointer dereference(s) --
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> +	//Test 'pbuf'(also known as 'error') against NULL, since it is called multiple places without checking against, causing null pointer dereferences.

No C++ comments please.

>  	if (buf.c) {
> -		*pbuf = buf.c;
> +		if(pbuf) {
> +			*pbuf = buf.c;
> +		}
>  		result = buf.len;

I think if pbuf is null, it should return 0 immediately. The code you
provided would result in a memory leak if pbuf is NULL, since the
pointer to buf.c would be lost as soon as vspprintf exits.

-- 
Stas Malyshev
smalyshev@gmail.com