Skip to content

Conversation

@pull
Copy link

@pull pull bot commented Feb 7, 2025

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.1)

Can you help keep this open source service alive? 💖 Please sponsor : )

If the returned buffer string is of length 0, then a realloc can happen
with length 0. However, the behaviour is implementation-defined.
From 7.20.3.1 of C11 spec:

> If the size of the space requested is zero, the behavior is
> implementation-defined: either a null pointer is returned,
> or the behavior is as if the size were some nonzero value,
> except that the returned pointer shall not be used to access an object

This is problematic for the test case on my system as it returns NULL,
causing a memleak and later using it in memcpy causing UB.
The bucket code is not prepared to handle a NULL pointer.
To solve this, we use MAX to clamp the size to 1 at the least.

Closes GH-17656.
* PHP-8.3:
  Fix GH-17650: realloc with size 0 in user_filters.c
* PHP-8.4:
  Fix GH-17650: realloc with size 0 in user_filters.c
@pull pull bot added the ⤵️ pull label Feb 7, 2025
@pull pull bot merged commit d3e5dbe into wudi:master Feb 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant