php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source 
* PHP-8.4:
  NEWS entries for LDAP bug fixes
  ext/ldap: Fix GH-16136 (Memory leak in php_ldap_do_modify())
  ext/ldap: Fix GH-16132 (Freeing pointer not allocated by ZMM)
This commit is contained in:
Gina Peter Banyard
2024-09-30 22:24:45 +01:00
parent 98a4c53ad5 747860ccf0
commit a6d111ff2a
4 changed files with 95 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
ext/ldap/ldap.c
View File

@@ -2236,17 +2236,11 @@ static void php_ldap_do_modify(INTERNAL_FUNCTION_PARAMETERS, int oper, int ext)
ldap_mods[i]->mod_type = estrndup(ZSTR_VAL(attribute), ZSTR_LEN(attribute)); ldap_mods[i]->mod_type = estrndup(ZSTR_VAL(attribute), ZSTR_LEN(attribute));
} else { } else {
php_error_docref(NULL, E_WARNING, "Unknown attribute in the data"); php_error_docref(NULL, E_WARNING, "Unknown attribute in the data");
/* Free allocated memory */ RETVAL_FALSE;
while (i >= 0) { num_berval[i] = 0;
if (ldap_mods[i]->mod_type) { num_attribs = i + 1;
efree(ldap_mods[i]->mod_type); ldap_mods[i]->mod_bvalues = NULL;
} goto cleanup;
efree(ldap_mods[i]);
i--;
}
efree(num_berval);
efree(ldap_mods);
RETURN_FALSE;
} }
value = zend_hash_get_current_data(Z_ARRVAL_P(entry)); value = zend_hash_get_current_data(Z_ARRVAL_P(entry));
@@ -2267,6 +2261,8 @@ static void php_ldap_do_modify(INTERNAL_FUNCTION_PARAMETERS, int oper, int ext)
convert_to_string(value); convert_to_string(value);
if (EG(exception)) { if (EG(exception)) {
RETVAL_FALSE; RETVAL_FALSE;
num_berval[i] = 0;
num_attribs = i + 1;
goto cleanup; goto cleanup;
} }
ldap_mods[i]->mod_bvalues[0] = (struct berval *) emalloc (sizeof(struct berval)); ldap_mods[i]->mod_bvalues[0] = (struct berval *) emalloc (sizeof(struct berval));
@@ -2283,6 +2279,8 @@ static void php_ldap_do_modify(INTERNAL_FUNCTION_PARAMETERS, int oper, int ext)
} }
convert_to_string(ivalue); convert_to_string(ivalue);
if (EG(exception)) { if (EG(exception)) {
num_berval[i] = j;
num_attribs = i + 1;
RETVAL_FALSE; RETVAL_FALSE;
goto cleanup; goto cleanup;
} }

28
ext/ldap/tests/gh16132-1.phpt Normal file
View File

@@ -0,0 +1,28 @@
--TEST--
Bug GH-16132: Attempting to free pointer not allocated by ZMM
--EXTENSIONS--
ldap
--FILE--
<?php
/* ldap_add(_ext)(), ldap_mod_replace(_ext)(), ldap_mod_add(_ext)(), and ldap_mod_del(_ext)() share an underlying C function */
/* We are assuming 3333 is not connectable */
$ldap = ldap_connect('ldap://127.0.0.1:3333');
$valid_dn = "cn=userA,something";
$dict_key_value_not_string = [
'attribute1' => new stdClass(),
'attribute2' => [
'value1',
'value2',
],
];
try {
var_dump(ldap_add($ldap, $valid_dn, $dict_key_value_not_string));
} catch (Throwable $e) {
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
}
?>
--EXPECT--
Error: Object of class stdClass could not be converted to string

28
ext/ldap/tests/gh16132-2.phpt Normal file
View File

@@ -0,0 +1,28 @@
--TEST--
Bug GH-16132: Attempting to free pointer not allocated by ZMM
--EXTENSIONS--
ldap
--FILE--
<?php
/* ldap_add(_ext)(), ldap_mod_replace(_ext)(), ldap_mod_add(_ext)(), and ldap_mod_del(_ext)() share an underlying C function */
/* We are assuming 3333 is not connectable */
$ldap = ldap_connect('ldap://127.0.0.1:3333');
$valid_dn = "cn=userA,something";
$dict_key_multi_value_not_list_of_strings2 = [
'attribute1' => 'value',
'attribute2' => [
'value1',
new stdClass(),
],
];
try {
var_dump(ldap_add($ldap, $valid_dn, $dict_key_multi_value_not_list_of_strings2));
} catch (Throwable $e) {
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
}
?>
--EXPECT--
Error: Object of class stdClass could not be converted to string

30
ext/ldap/tests/gh16136.phpt Normal file
View File

@@ -0,0 +1,30 @@
--TEST--
Bug GH-16136: Memory leak in php_ldap_do_modify() when entry is not a proper dictionary
--EXTENSIONS--
ldap
--FILE--
<?php
/* ldap_add(_ext)(), ldap_mod_replace(_ext)(), ldap_mod_add(_ext)(), and ldap_mod_del(_ext)() share an underlying C function */
/* We are assuming 3333 is not connectable */
$ldap = ldap_connect('ldap://127.0.0.1:3333');
$valid_dn = "cn=userA,something";
$not_dict_of_attributes = [
'attribute1' => 'value',
'not_key_entry',
'attribute3' => [
'value1',
'value2',
],
];
try {
var_dump(ldap_add($ldap, $valid_dn, $not_dict_of_attributes));
} catch (Throwable $e) {
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
}
?>
--EXPECTF--
Warning: ldap_add(): Unknown attribute in the data in %s on line %d
bool(false)