[pull] master from php:master - #914
Merged
Merged
Conversation
convert_zstr_to_gmp() passes PHP strings to mpz_set_str(), which treats input as a NUL-terminated C string. This allowed strings like "123\0abc" to be accepted as 123. Reject strings containing NUL bytes with zend_str_has_nul_byte() before calling into GMP, preserving the existing "not an integer string" error path.
- php_if_index_to_addr4()/php_add4_to_if_index() use-after-free on the Windows address table. GetIpAddrTable() was retried against addr_table after an erealloc() whose return value was discarded, so on ERROR_INSUFFICIENT_BUFFER it wrote into the freed block. Assign the reallocated pointer back before retrying. - socket_import_stream() double-close of the stream descriptor on error. socket_import_file_descriptor() sets bsd_socket before zstream is copied, so a failing import freed the object with zstream still UNDEF and closed the fd still owned by the stream. Invalidate bsd_socket on the error path. - socket_set_option() data race on the reuseport CBPF filter buffers. The cbpf/bpfprog buffers were function-local statics shared across threads, so concurrent SO_ATTACH_REUSEPORT_CBPF calls could install a torn filter. Move them to function scope so they outlive the block up to setsockopt() without being shared. - socket_get_option() leaks uninitialized bytes for sub-int options. The generic path only corrected 1-byte options; an option returning 0/2/3 bytes left the high bytes of other_val uninitialized before RETURN_LONG. Zero-initialize it before getsockopt(). - to_zval_read_iov() missing bail out on oversized iov_len. The error was recorded but execution fell through to array_init_size() and the loop with a truncated length. Return right after reporting it. close GH-22794
* PHP-8.4: ext/sockets: memory related issues fix.
* PHP-8.5: ext/sockets: memory related issues fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )