archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.4'

Browse source 
* PHP-8.4:
  Fix GH-17650: realloc with size 0 in user_filters.c
This commit is contained in:
Niels Dossche 2025-02-07 20:24:07 +01:00
commit d3e5dbe45b
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
2 changed files with 36 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

35
ext/standard/tests/streams/gh17650.phpt Normal file
View file

@ -0,0 +1,35 @@
--TEST--
GH-17650 (realloc with size 0 in user_filters.c)
--FILE--
<?php
class testfilter extends php_user_filter {
function filter($in, $out, &$consumed, $closing): int {
while ($bucket = stream_bucket_make_writeable($in)) {
$bucket->data = '';
$consumed += strlen($bucket->data);
stream_bucket_append($out, $bucket);
}
return PSFS_PASS_ON;
}
}
stream_filter_register('testfilter','testfilter');
$text = "Hello There!";
$fp = fopen('php://memory', 'w+');
fwrite($fp, $text);
rewind($fp);
stream_filter_append($fp, 'testfilter', STREAM_FILTER_READ, 'testuserfilter');
while ($x = fgets($fp)) {
var_dump($x);
}
fclose($fp);
echo "Done\n";
?>
--EXPECT--
Done

2
ext/standard/user_filters.c
View file

@ -402,7 +402,7 @@ static void php_stream_bucket_attach(int append, INTERNAL_FUNCTION_PARAMETERS)
bucket = php_stream_bucket_make_writeable(bucket);
}
if (bucket->buflen != Z_STRLEN_P(pzdata)) {
bucket->buf = perealloc(bucket->buf, Z_STRLEN_P(pzdata), bucket->is_persistent);
bucket->buf = perealloc(bucket->buf, MAX(Z_STRLEN_P(pzdata), 1), bucket->is_persistent);
bucket->buflen = Z_STRLEN_P(pzdata);
}
memcpy(bucket->buf, Z_STRVAL_P(pzdata), bucket->buflen);