|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #75867 Freeing uninitialized pointer
Submitted: 2018-01-24 02:51 UTC Modified: 2018-02-24 22:29 UTC
From: mike at flyn dot org Assigned: cmb (profile)
Status: Closed Package: ICONV related
PHP Version: 7.2.1 OS: Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: mike at flyn dot org
New email:
PHP Version: OS:


 [2018-01-24 02:51 UTC] mike at flyn dot org
In iconv.c, it is possible that out_buffer might be free'd without every having been made to point to a valid heap address. This is because stack variables are not implicitly initialized, and php_iconv_string might fail, thus never initializing &out_buffer.

See the attached patch.


php_iconv_string-out-pointer-initialize (last revision 2018-01-24 03:15 UTC by philipp at redfish-solutions dot com)
fix-initialization.patch (last revision 2018-01-24 02:51 UTC by mike at flyn dot org)

Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2018-01-24 03:19 UTC] philipp at redfish-solutions dot com
One path through the conditional code of php_iconv_string() NULL's the pointer *out.  The other path doesn't.  This seems broken, or at the very least, extremely risky.

NULL it out on either path so that if we bail early on an error condition, it's consistently set the same.
 [2018-02-24 22:29 UTC]
-Status: Open +Status: Closed -Assigned To: +Assigned To: cmb
 [2018-02-24 22:29 UTC]
This issue has been resolved by merging
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Thu May 13 21:01:23 2021 UTC