fix(localization): critical memory safety bugs in encoding conversion#1555
fix(localization): critical memory safety bugs in encoding conversion#1555David-Engel merged 10 commits intomicrosoft:devfrom
Conversation
CRITICAL FIXES: 1. Fixed NULL pointer dereference in SystemLocale::NextChar() - Added NULL check to prevent crash when start pointer is NULL - Prevents DoS attack via malformed encoding input 2. Fixed uninitialized pointer return in IConvCachePool::Borrow() - Explicitly set pCache to NULL after failed allocation - Prevents undefined behavior and potential memory corruption - Eliminates use-after-free/information disclosure risk These memory safety vulnerabilities affect the SQL Server PHP driver when handling user-provided data with specific encoding conditions.
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
@SajanGhimire1 Thanks for raising the PR for this fix, Can you please check why is the pipeline failing for all OSs and fix it, also I would like you to add some tests to check if the code that you have added really works. |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Added a NULL pointer check in NextChar to prevent crashes.
@jahnvi480 I’ve added the NULL pointer check in NextChar() and explicitly set pCache = NULL in IConvCachePool::Borrow(). These changes fix the memory safety issues and don’t alter any other logic. |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
@SajanGhimire1 MacOs and Linux tests are failing can you check on this |
iam working on this. |
@jahnvi480 |
|
Pipeline is expected to run drivers build on all OSs |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
3 participants
CRITICAL FIXES:
Fixed NULL pointer dereference in SystemLocale::NextChar()
Fixed uninitialized pointer return in IConvCachePool::Borrow()
These memory safety vulnerabilities affect the SQL Server PHP driver when handling user-provided data with specific encoding conditions.