php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #71729 Possible crash in zend_bin_strtod, zend_oct_strtod, zend_hex_strtod
Submitted: 2016-03-07 11:12 UTC Modified: -
From: temp at temp dot ru Assigned:
Status: Closed Package: *General Issues
PHP Version: 7.0.4 OS:
Private report: No CVE-ID:
 [2016-03-07 11:12 UTC] temp at temp dot ru
Description:
------------
These three function has a flaw that can eventually result in crash:

ZEND_API double zend_bin_strtod(const char *str, const char **endptr)
{
...
	if (strlen(str) < 2) {
		*endptr = str; <--- No check if endptr is NULL, can result in zero pointer dereferencing
		return 0.0;
	}

...

	if (NULL != endptr) {  <--- But here this check is present
		*endptr = (char *)(any ? s - 1 : str);
	}

	return value;
}


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-03-09 04:17 UTC] laruence@php.net
Automatic comment on behalf of laruence@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=9aa73d38000b9bb9de8dc8aa96e7dcef30506202
Log: Fixed bug #71729 (Possible crash in zend_bin_strtod, zend_oct_strtod, zend_hex_strtod)
 [2016-03-09 04:17 UTC] laruence@php.net
-Status: Open +Status: Closed
 [2016-07-20 11:33 UTC] davey@php.net
Automatic comment on behalf of laruence@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=9aa73d38000b9bb9de8dc8aa96e7dcef30506202
Log: Fixed bug #71729 (Possible crash in zend_bin_strtod, zend_oct_strtod, zend_hex_strtod)
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Sun Apr 30 18:01:35 2017 UTC