Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:80968
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.44 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <1421785688-23331-1-git-send-email-git@internot.info>
References: <1421785688-23331-1-git-send-email-git@internot.info>
Date: Thu, 22 Jan 2015 19:36:27 +0900
Message-ID: <CAGa2bXb-rx00ycqVfKc78FbHZK4g8_6pQYMo4o-R49i0eV-jmQ@mail.gmail.com>
To: Joshua Rogers <git@internot.info>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e015371d0fbd4ff050d3b40b8
Subject: Re: [PHP-DEV] [PATCH] Fix uninitalized variables reads. See CWE-457
 for more info.
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e015371d0fbd4ff050d3b40b8
Content-Type: text/plain; charset=UTF-8

Hi Joshua,

On Wed, Jan 21, 2015 at 5:28 AM, Joshua Rogers <git@internot.info> wrote:

>  ext/mbstring/mbstring.c         | 8 ++++----
>  ext/reflection/php_reflection.c | 1 +
>  main/main.c                     | 1 +
>  3 files changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
> index 7f2209f..504a5e6 100644
> --- a/ext/mbstring/mbstring.c
> +++ b/ext/mbstring/mbstring.c
> @@ -3891,7 +3891,7 @@ static int _php_mbstr_parse_mail_headers(HashTable
> *ht, const char *str, size_t
>         int state = 0;
>         int crlf_state = -1;
>         char *token = NULL;
> -       size_t token_pos;
> +       size_t token_pos = 0;
>         zend_string *fld_name, *fld_val;
>
>         ps = str;
> @@ -3917,7 +3917,7 @@ static int _php_mbstr_parse_mail_headers(HashTable
> *ht, const char *str, size_t
>                                 }
>
>                                 if (state == 0 || state == 1) {
> -                                       if(token) {
> +                                       if(token && token_pos > 0) {
>                                                 fld_name =
> zend_string_init(token, token_pos, 0);
>                                         }
>                                         state = 2;
> @@ -3983,7 +3983,7 @@ static int _php_mbstr_parse_mail_headers(HashTable
> *ht, const char *str, size_t
>
>                                         case 3:
>                                                 if (crlf_state == -1) {
> -                                                       if(token) {
> +                                                       if(token &&
> token_pos > 0) {
>                                                                 fld_val =
> zend_string_init(token, token_pos, 0);
>                                                         }
>
> @@ -4032,7 +4032,7 @@ out:
>                 state = 3;
>         }
>         if (state == 3) {
> -               if(token) {
> +               if(token && token_pos > 0) {
>                         fld_val = zend_string_init(token, token_pos, 0);
>                 }
>                 if (fld_name != NULL && fld_val != NULL) {
> diff --git a/ext/reflection/php_reflection.c
> b/ext/reflection/php_reflection.c
> index 3f5c7a9..1f5085c 100644
> --- a/ext/reflection/php_reflection.c
> +++ b/ext/reflection/php_reflection.c
> @@ -3978,6 +3978,7 @@ static int _adddynproperty(zval *ptr, int num_args,
> va_list args, zend_hash_key
>         if (zend_get_property_info(ce, hash_key->key, 1) == NULL) {
>                 zend_property_info property_info;
>
> +               property_info.doc_comment = NULL;
>                 property_info.flags = ZEND_ACC_IMPLICIT_PUBLIC;
>                 property_info.name = hash_key->key;
>                 property_info.ce = ce;
> diff --git a/main/main.c b/main/main.c
> index 3aef805..50d0161 100644
> --- a/main/main.c
> +++ b/main/main.c
> @@ -2255,6 +2255,7 @@ int php_module_startup(sapi_module_struct *sf,
> zend_module_entry *additional_mod
>
>         zuv.html_errors = 1;
>         zuv.import_use_extension = ".php";
> +       zuv.import_use_extension_length =
> (uint)strlen(zuv.import_use_extension);
>         php_startup_auto_globals();
>         zend_set_utility_values(&zuv);
>         php_startup_sapi_content_types();
>

Could you send pull request from github?
It's not required strictly, but if you can includes tests, it would be
great.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e015371d0fbd4ff050d3b40b8--