php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix memory leak on overflow in _php_stream_scandir()

Browse Source 
On overflow, only the array is freed, but not the strings.

Closes GH-17789.
This commit is contained in:
Niels Dossche
2025-02-13 19:49:13 +01:00
parent 302165837f
commit 678ecff980
2 changed files with 14 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@@ -41,6 +41,7 @@ PHP NEWS
- Streams:
. Fixed bug GH-17650 (realloc with size 0 in user_filters.c). (nielsdos)
. Fix memory leak on overflow in _php_stream_scandir(). (nielsdos)
- Windows:
. Fixed phpize for Windows 11 (24H2). (bwoebi)

24
main/streams/streams.c
View File

@@ -2469,25 +2469,19 @@ PHPAPI int _php_stream_scandir(const char *dirname, zend_string **namelist[], in
vector_size = 10;
} else {
if(vector_size*2 < vector_size) {
/* overflow */
php_stream_closedir(stream);
efree(vector);
return -1;
goto overflow;
}
vector_size *= 2;
}
vector = (zend_string **) safe_erealloc(vector, vector_size, sizeof(char *), 0);
vector = (zend_string **) safe_erealloc(vector, vector_size, sizeof(zend_string *), 0);
}
vector[nfiles] = zend_string_init(sdp.d_name, strlen(sdp.d_name), 0);
nfiles++;
if(vector_size < 10 || nfiles == 0) {
/* overflow */
php_stream_closedir(stream);
efree(vector);
return -1;
if(vector_size < 10 || nfiles + 1 == 0) {
goto overflow;
}
nfiles++;
}
php_stream_closedir(stream);
@@ -2497,5 +2491,13 @@ PHPAPI int _php_stream_scandir(const char *dirname, zend_string **namelist[], in
qsort(*namelist, nfiles, sizeof(zend_string *), (int(*)(const void *, const void *))compare);
}
return nfiles;
overflow:
php_stream_closedir(stream);
for (unsigned int i = 0; i < nfiles; i++) {
zend_string_efree(vector[i]);
}
efree(vector);
return -1;
}
/* }}} */