laruence Sun, 07 Aug 2011 13:19:04 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=314422
Log:
Fixed bug that may dereferenced NULL pointer before checking
Changed paths:
U php/php-src/branches/PHP_5_3/ext/standard/basic_functions.c
U php/php-src/branches/PHP_5_4/ext/standard/basic_functions.c
U php/php-src/trunk/ext/standard/basic_functions.c
Modified: php/php-src/branches/PHP_5_3/ext/standard/basic_functions.c
===================================================================
--- php/php-src/branches/PHP_5_3/ext/standard/basic_functions.c 2011-08-07
13:10:10 UTC (rev 314421)
+++ php/php-src/branches/PHP_5_3/ext/standard/basic_functions.c 2011-08-07
13:19:04 UTC (rev 314422)
@@ -4313,15 +4313,15 @@
/* the first <len> slots are filled by the one short ops
* we now extend our array and jump to the new added structs */
opts = (opt_struct *) erealloc(opts, sizeof(opt_struct) * (len
+ count + 1));
+ if (!opts) {
+ RETURN_FALSE;
+ }
+
orig_opts = opts;
opts += len;
memset(opts, 0, count * sizeof(opt_struct));
- if (!opts) {
- RETURN_FALSE;
- }
-
/* Reset the array indexes. */
zend_hash_internal_pointer_reset(Z_ARRVAL_P(p_longopts));
@@ -4358,6 +4358,10 @@
}
} else {
opts = (opt_struct*) erealloc(opts, sizeof(opt_struct) * (len +
1));
+ if (!opts) {
+ RETURN_FALSE;
+ }
+
orig_opts = opts;
opts += len;
}
Modified: php/php-src/branches/PHP_5_4/ext/standard/basic_functions.c
===================================================================
--- php/php-src/branches/PHP_5_4/ext/standard/basic_functions.c 2011-08-07
13:10:10 UTC (rev 314421)
+++ php/php-src/branches/PHP_5_4/ext/standard/basic_functions.c 2011-08-07
13:19:04 UTC (rev 314422)
@@ -4252,15 +4252,15 @@
/* the first <len> slots are filled by the one short ops
* we now extend our array and jump to the new added structs */
opts = (opt_struct *) erealloc(opts, sizeof(opt_struct) * (len
+ count + 1));
+ if (!opts) {
+ RETURN_FALSE;
+ }
+
orig_opts = opts;
opts += len;
memset(opts, 0, count * sizeof(opt_struct));
- if (!opts) {
- RETURN_FALSE;
- }
-
/* Reset the array indexes. */
zend_hash_internal_pointer_reset(Z_ARRVAL_P(p_longopts));
@@ -4297,6 +4297,10 @@
}
} else {
opts = (opt_struct*) erealloc(opts, sizeof(opt_struct) * (len +
1));
+ if (!opts) {
+ RETURN_FALSE;
+ }
+
orig_opts = opts;
opts += len;
}
Modified: php/php-src/trunk/ext/standard/basic_functions.c
===================================================================
--- php/php-src/trunk/ext/standard/basic_functions.c 2011-08-07 13:10:10 UTC
(rev 314421)
+++ php/php-src/trunk/ext/standard/basic_functions.c 2011-08-07 13:19:04 UTC
(rev 314422)
@@ -4282,15 +4282,15 @@
/* the first <len> slots are filled by the one short ops
* we now extend our array and jump to the new added structs */
opts = (opt_struct *) erealloc(opts, sizeof(opt_struct) * (len
+ count + 1));
+ if (!opts) {
+ RETURN_FALSE;
+ }
+
orig_opts = opts;
opts += len;
memset(opts, 0, count * sizeof(opt_struct));
- if (!opts) {
- RETURN_FALSE;
- }
-
/* Reset the array indexes. */
zend_hash_internal_pointer_reset(Z_ARRVAL_P(p_longopts));
@@ -4327,6 +4327,10 @@
}
} else {
opts = (opt_struct*) erealloc(opts, sizeof(opt_struct) * (len +
1));
+ if (!opts) {
+ RETURN_FALSE;
+ }
+
orig_opts = opts;
opts += len;
}
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
