1
0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Files
archived-php-src/main
Niels Dossche aab784263d Fix GH-16998: UBSAN warning in rfc1867
The "else branch" of `next_line` can reset the `buf_begin` field to
NULL, causing the next invocation to pass NULL to `memchr` with a 0
length. When UBSAN is enabled this causes an UBSAN abort. Real world
impact is likely none because of the 0 length.

To fix this, don't set the pointer to NULL, which means that the
`memchr` will return NULL and since
`self->bytes_in_buffer < self->bufsize` we return NULL and request more
data through `fill_buffer`. That function will reset `buf_begin` and
`bytes_in_buffer` so that the next invocation works fine.

I chose this solution so we have an invariant that `buf_begin` is never
NULL, which makes reasoning easier. An alternative solution is keeping
the NULLing of `buf_begin` and add an extra check at the top of
`next_line`, but I didn't like special casing this.

Closes GH-17000.
2024-12-01 10:59:30 +01:00
..
2022-09-29 15:15:40 +02:00
2022-07-19 10:27:38 +01:00
2022-08-29 22:34:48 +01:00
2021-08-02 15:59:26 +02:00
2021-11-24 16:13:34 +03:00