Skip to content

Commit 3c23084

Browse files
committed
Fix strict aliasing violation in phpdbg
By explicitly computing the message length from bytes. This also makes sure that the length is interpreted in an endianness-independent manner.
1 parent 4cfa4fb commit 3c23084

File tree

2 files changed

+14
-10
lines changed

2 files changed

+14
-10
lines changed

ext/xsl/xsltprocessor.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,7 @@ static char **php_xsl_xslt_make_params(HashTable *parht, int xpath_params)
174174
static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int type) /* {{{ */
175175
{
176176
xsltTransformContextPtr tctxt;
177-
zval *args;
177+
zval *args = NULL;
178178
zval retval;
179179
int result, i;
180180
int error = 0;

sapi/phpdbg/phpdbg_wait.c

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -379,21 +379,25 @@ PHPDBG_COMMAND(wait) /* {{{ */
379379
return FAILURE;
380380
}
381381

382-
char msglen[5];
383-
int recvd = 4;
382+
unsigned char msglen_buf[4];
383+
int needed = 4;
384384

385385
do {
386-
recvd -= recv(sr, &(msglen[4 - recvd]), recvd, 0);
387-
} while (recvd > 0);
386+
needed -= recv(sr, &msglen_buf[4 - needed], needed, 0);
387+
} while (needed > 0);
388388

389-
recvd = *(size_t *) msglen;
390-
char *data = emalloc(recvd);
389+
uint32_t msglen = (msglen_buf[3] << 24)
390+
| (msglen_buf[2] << 16)
391+
| (msglen_buf[1] << 8)
392+
| (msglen_buf[0] << 0);
393+
char *data = emalloc(msglen);
394+
needed = msglen;
391395

392396
do {
393-
recvd -= recv(sr, &(data[(*(int *) msglen) - recvd]), recvd, 0);
394-
} while (recvd > 0);
397+
needed -= recv(sr, &(data[msglen - needed]), needed, 0);
398+
} while (needed > 0);
395399

396-
phpdbg_webdata_decompress(data, *(int *) msglen);
400+
phpdbg_webdata_decompress(data, msglen);
397401

398402
if (PHPDBG_G(socket_fd) != -1) {
399403
close(PHPDBG_G(socket_fd));

0 commit comments

Comments
 (0)