mirror of
https://github.com/php/php-src.git
synced 2026-03-24 00:02:20 +01:00
ddbd396aa2
The first while loop sets the bucket variable, and this is freed in out_failure. However, when the second "goto out_failure" is triggered then bucket still refers to the bucket from the first while loop, causing a UAF. Fix this by separating the error paths. Closes GH-17058.
18 lines
498 B
PHP
18 lines
498 B
PHP
--TEST--
|
|
GH-17047 (UAF on iconv filter failure)
|
|
--EXTENSIONS--
|
|
iconv
|
|
--FILE--
|
|
<?php
|
|
$stream = fopen('php://temp', 'w+');
|
|
stream_filter_append($stream, 'convert.iconv.UTF-16BE.UTF-8');
|
|
stream_filter_append($stream, 'convert.iconv.UTF-16BE.UTF-16BE');
|
|
fputs($stream, 'test');
|
|
rewind($stream);
|
|
var_dump(stream_get_contents($stream));
|
|
fclose($stream);
|
|
?>
|
|
--EXPECTF--
|
|
Warning: stream_get_contents(): iconv stream filter ("UTF-16BE"=>"UTF-16BE"): invalid multibyte sequence in %s on line %d
|
|
string(0) ""
|