mirror of
https://github.com/php/php-src.git
synced 2025-08-16 05:58:45 +02:00
ext/ldap: Fix GH-16132 (Freeing pointer not allocated by ZMM)
Closes GH-16134
This commit is contained in:
parent
332b067c5e
commit
c910e78c39
3 changed files with 60 additions and 0 deletions
|
@ -2181,6 +2181,8 @@ static void php_ldap_do_modify(INTERNAL_FUNCTION_PARAMETERS, int oper, int ext)
|
||||||
convert_to_string(value);
|
convert_to_string(value);
|
||||||
if (EG(exception)) {
|
if (EG(exception)) {
|
||||||
RETVAL_FALSE;
|
RETVAL_FALSE;
|
||||||
|
num_berval[i] = 0;
|
||||||
|
num_attribs = i + 1;
|
||||||
goto cleanup;
|
goto cleanup;
|
||||||
}
|
}
|
||||||
ldap_mods[i]->mod_bvalues[0] = (struct berval *) emalloc (sizeof(struct berval));
|
ldap_mods[i]->mod_bvalues[0] = (struct berval *) emalloc (sizeof(struct berval));
|
||||||
|
@ -2197,6 +2199,8 @@ static void php_ldap_do_modify(INTERNAL_FUNCTION_PARAMETERS, int oper, int ext)
|
||||||
}
|
}
|
||||||
convert_to_string(ivalue);
|
convert_to_string(ivalue);
|
||||||
if (EG(exception)) {
|
if (EG(exception)) {
|
||||||
|
num_berval[i] = j;
|
||||||
|
num_attribs = i + 1;
|
||||||
RETVAL_FALSE;
|
RETVAL_FALSE;
|
||||||
goto cleanup;
|
goto cleanup;
|
||||||
}
|
}
|
||||||
|
|
28
ext/ldap/tests/gh16132-1.phpt
Normal file
28
ext/ldap/tests/gh16132-1.phpt
Normal file
|
@ -0,0 +1,28 @@
|
||||||
|
--TEST--
|
||||||
|
Bug GH-16132: Attempting to free pointer not allocated by ZMM
|
||||||
|
--EXTENSIONS--
|
||||||
|
ldap
|
||||||
|
--FILE--
|
||||||
|
<?php
|
||||||
|
|
||||||
|
/* ldap_add(_ext)(), ldap_mod_replace(_ext)(), ldap_mod_add(_ext)(), and ldap_mod_del(_ext)() share an underlying C function */
|
||||||
|
/* We are assuming 3333 is not connectable */
|
||||||
|
$ldap = ldap_connect('ldap://127.0.0.1:3333');
|
||||||
|
$valid_dn = "cn=userA,something";
|
||||||
|
|
||||||
|
$dict_key_value_not_string = [
|
||||||
|
'attribute1' => new stdClass(),
|
||||||
|
'attribute2' => [
|
||||||
|
'value1',
|
||||||
|
'value2',
|
||||||
|
],
|
||||||
|
];
|
||||||
|
try {
|
||||||
|
var_dump(ldap_add($ldap, $valid_dn, $dict_key_value_not_string));
|
||||||
|
} catch (Throwable $e) {
|
||||||
|
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
|
||||||
|
}
|
||||||
|
|
||||||
|
?>
|
||||||
|
--EXPECT--
|
||||||
|
Error: Object of class stdClass could not be converted to string
|
28
ext/ldap/tests/gh16132-2.phpt
Normal file
28
ext/ldap/tests/gh16132-2.phpt
Normal file
|
@ -0,0 +1,28 @@
|
||||||
|
--TEST--
|
||||||
|
Bug GH-16132: Attempting to free pointer not allocated by ZMM
|
||||||
|
--EXTENSIONS--
|
||||||
|
ldap
|
||||||
|
--FILE--
|
||||||
|
<?php
|
||||||
|
|
||||||
|
/* ldap_add(_ext)(), ldap_mod_replace(_ext)(), ldap_mod_add(_ext)(), and ldap_mod_del(_ext)() share an underlying C function */
|
||||||
|
/* We are assuming 3333 is not connectable */
|
||||||
|
$ldap = ldap_connect('ldap://127.0.0.1:3333');
|
||||||
|
$valid_dn = "cn=userA,something";
|
||||||
|
|
||||||
|
$dict_key_multi_value_not_list_of_strings2 = [
|
||||||
|
'attribute1' => 'value',
|
||||||
|
'attribute2' => [
|
||||||
|
'value1',
|
||||||
|
new stdClass(),
|
||||||
|
],
|
||||||
|
];
|
||||||
|
try {
|
||||||
|
var_dump(ldap_add($ldap, $valid_dn, $dict_key_multi_value_not_list_of_strings2));
|
||||||
|
} catch (Throwable $e) {
|
||||||
|
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
|
||||||
|
}
|
||||||
|
|
||||||
|
?>
|
||||||
|
--EXPECT--
|
||||||
|
Error: Object of class stdClass could not be converted to string
|
Loading…
Add table
Add a link
Reference in a new issue