|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2008-12-26 20:55 UTC] dvice_null at yahoo dot com
Description:
------------
In file ext/date/lib/parse_tz.c:99:
Variable "buffer" leaks memory if "cbuffer" is null in this code:
if (!cbuffer) {
return;
}
This bug was found using cppcheck: http://cppcheck.wiki.sourceforge.net/
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sat Oct 25 10:00:01 2025 UTC |
Two similar problems in the same file. Let me know if you want separate bug reports about these: ---------------- ext/date/lib/parse_tz.c:124]: Memory leak: buffer if (!tz->type) { return; } ---------------- ext/date/lib/parse_tz.c:152: Memory leak: leap_buffer if (!tz->leap_times) { return; }I think something like this: Index: ext/date/lib/parse_tz.c =================================================================== RCS file: /repository/php-src/ext/date/lib/parse_tz.c,v retrieving revision 1.20.2.6.2.13.2.4 diff -u -p -r1.20.2.6.2.13.2.4 parse_tz.c --- ext/date/lib/parse_tz.c 9 Aug 2008 22:01:08 -0000 1.20.2.6.2.13.2.4 +++ ext/date/lib/parse_tz.c 26 Dec 2008 21:47:20 -0000 @@ -100,6 +100,7 @@ static void read_transistions(char **tzf cbuffer = (unsigned char*) malloc(tz->timecnt * sizeof(unsigned char)); if (!cbuffer) { + free(buffer); return; } memcpy(cbuffer, *tzf, sizeof(unsigned char) * tz->timecnt); @@ -125,6 +126,7 @@ static void read_types(char **tzf, timel tz->type = (ttinfo*) malloc(tz->typecnt * sizeof(struct ttinfo)); if (!tz->type) { + free(buffer); return; } @@ -153,6 +155,9 @@ static void read_types(char **tzf, timel tz->leap_times = (tlinfo*) malloc(tz->leapcnt * sizeof(tlinfo)); if (!tz->leap_times) { + free(leap_buffer); + free(tz->timezone_abbr); + free(tz->types); return; } for (i = 0; i < tz->leapcnt; i++) {