1
0
mirror of https://github.com/php/php-src.git synced 2026-04-07 16:13:32 +02:00
Files
archived-php-src/Zend/tests
Niels Dossche 727e26f9f2 Fix #97836 and #81705: Segfault / type confusion in concat_function
The following sequence of actions was happening which caused a null
pointer dereference:
1. debug_backtrace() returns an array
2. The concatenation to $c will transform the array to a string via
   `zval_get_string_func` for op2 and output a warning.
   Note that zval op1 is of type string due to the first do-while
   sequence.
3. The warning of an implicit "array to string conversion" triggers
   the ob_start callback to run. This code transform $c (==op1) to a long.
4. The code below the 2 do-while sequences assume that both op1 and op2
   are strings, but this is no longer the case. A dereference of the
   string will therefore result in a null pointer dereference.

The solution used here is to work with the zend_string directly instead
of with the ops.

For the tests:
Co-authored-by: changochen1@gmail.com
Co-authored-by: cmbecker69@gmx.de
Co-authored-by: yukik@risec.co.jp

Closes GH-10049.
2023-05-16 20:27:00 +02:00
..
2021-07-20 12:05:46 +02:00
2022-12-20 16:41:07 +01:00
2022-07-15 13:19:12 +02:00
2021-07-15 10:09:56 +02:00
2020-09-29 11:04:09 +02:00
2021-10-11 16:01:57 +02:00
2021-07-15 10:09:56 +02:00
2021-10-11 16:01:57 +02:00
2020-09-18 14:28:32 +02:00
2021-10-11 16:01:57 +02:00
2021-02-18 14:17:47 +01:00
2020-09-18 14:28:32 +02:00
2021-05-29 11:33:13 +02:00
2021-10-11 16:01:57 +02:00
2020-09-18 14:28:32 +02:00
2020-09-14 10:14:21 +02:00
2020-09-18 14:28:32 +02:00
2021-02-24 19:12:32 +03:00
2021-02-24 19:12:32 +03:00
2021-10-18 12:45:26 +02:00
2021-02-18 11:39:28 +01:00
2020-09-18 14:28:32 +02:00
2021-05-29 11:33:13 +02:00
2021-06-02 23:19:38 +02:00
2020-09-18 14:28:32 +02:00
2020-08-31 12:38:11 +02:00
2020-09-18 14:28:32 +02:00
2020-09-03 10:29:18 +02:00
2020-09-03 11:19:04 +02:00
2020-09-03 17:12:40 +02:00
2020-10-15 14:24:25 +02:00
2020-09-14 15:49:49 +02:00
2020-10-06 16:33:14 +02:00
2020-10-06 16:33:14 +02:00
2020-10-05 15:24:51 +02:00
2020-10-07 15:03:12 +02:00
2020-10-19 15:13:53 +02:00
2020-11-24 10:09:28 +01:00
2020-11-24 11:35:44 +01:00
2021-03-01 16:30:01 +01:00
2021-06-01 12:07:33 +02:00
2021-08-12 14:35:13 +02:00
2021-08-12 14:35:13 +02:00
2021-08-24 15:05:53 +02:00
2021-11-16 12:45:33 +01:00
2021-11-24 15:18:31 +01:00
2022-05-11 11:43:01 +03:00
2022-12-19 12:11:16 +03:00
2022-02-11 15:16:08 +03:00
2021-07-15 10:09:56 +02:00
2021-07-15 10:09:56 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2021-07-12 11:30:20 +02:00
2022-09-19 13:12:49 +03:00
2022-03-20 20:54:36 +01:00
2022-03-20 20:54:36 +01:00
2022-03-20 20:54:36 +01:00
2022-03-20 20:54:36 +01:00
2022-03-20 20:54:36 +01:00
2023-04-16 15:34:56 +02:00
2023-04-16 15:34:56 +02:00
2023-03-06 15:03:19 +01:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-10-12 16:35:09 +02:00
2022-09-26 11:43:38 +03:00
2021-07-31 08:34:57 +02:00