|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #75867 Freeing uninitialized pointer
Submitted: 2018-01-24 02:51 UTC Modified: 2018-02-24 22:29 UTC
From: mike at flyn dot org Assigned: cmb (profile)
Status: Closed Package: ICONV related
PHP Version: 7.2.1 OS: Linux
Private report: No CVE-ID: None
 [2018-01-24 02:51 UTC] mike at flyn dot org
In iconv.c, it is possible that out_buffer might be free'd without every having been made to point to a valid heap address. This is because stack variables are not implicitly initialized, and php_iconv_string might fail, thus never initializing &out_buffer.

See the attached patch.


php_iconv_string-out-pointer-initialize (last revision 2018-01-24 03:15 UTC by philipp at redfish-solutions dot com)
fix-initialization.patch (last revision 2018-01-24 02:51 UTC by mike at flyn dot org)

Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2018-01-24 03:19 UTC] philipp at redfish-solutions dot com
One path through the conditional code of php_iconv_string() NULL's the pointer *out.  The other path doesn't.  This seems broken, or at the very least, extremely risky.

NULL it out on either path so that if we bail early on an error condition, it's consistently set the same.
 [2018-02-24 22:29 UTC]
-Status: Open +Status: Closed -Assigned To: +Assigned To: cmb
 [2018-02-24 22:29 UTC]
This issue has been resolved by merging
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Mon Mar 04 04:01:28 2024 UTC