php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #68741 Null pointer dereference
Submitted: 2015-01-04 12:16 UTC Modified: 2015-03-23 01:21 UTC
From: bugreports at internot dot info Assigned: laruence (profile)
Status: Closed Package: *Database Functions
PHP Version: master-Git-2015-01-04 (Git) OS: Linux Ubuntu 14.04
Private report: No CVE-ID: 2015-1352
View Developer Edit
 [2015-01-04 12:16 UTC] bugreports at internot dot info 
Description:
------------
Hi,

In /ext/pgsql/pgsql.c:

6447        token = php_strtok_r(table_copy, ".", &tmp);
6448        len = strlen(token);

'token' may return NULL, leading to a null pointer deference.

Elsewhere, the result of php_strtok_r() is checked against NULL, and should be here too.

A quick look shows that this may be reproducable by running
pg_insert() with a NULL table-name.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-01-08 08:09 UTC] laruence@php.net 
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=124fb22a13fafa3648e4e15b4f207c7096d8155e
Log: Fixed bug #68739 #68740 #68741
 [2015-01-08 08:15 UTC] laruence@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: laruence
 [2015-01-08 08:15 UTC] laruence@php.net 
The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.
 [2015-03-18 12:44 UTC] kaplan@php.net
-CVE-ID: +CVE-ID: 2015-1352
 [2015-03-23 01:21 UTC] stas@php.net
-Summary: Null pointer deference +Summary: Null pointer dereference
 [2015-03-23 01:33 UTC] stas@php.net 
Automatic comment on behalf of stas
Revision: http://git.php.net/?p=php-src.git;a=commit;h=968fbc6acf0bc27be17c0209be7f966e89a55943
Log: Bacport fix bug #68741 - Null pointer dereference
 [2016-07-20 11:40 UTC] davey@php.net 
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=124fb22a13fafa3648e4e15b4f207c7096d8155e
Log: Fixed bug #68739 #68740 #68741
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 12:01:29 2024 UTC