laruence                                 Sun, 07 Aug 2011 13:19:04 +0000

Revision: http://svn.php.net/viewvc?view=revision&revision=314422

Log:
Fixed bug that may dereferenced NULL pointer before checking

Changed paths:
    U   php/php-src/branches/PHP_5_3/ext/standard/basic_functions.c
    U   php/php-src/branches/PHP_5_4/ext/standard/basic_functions.c
    U   php/php-src/trunk/ext/standard/basic_functions.c

Modified: php/php-src/branches/PHP_5_3/ext/standard/basic_functions.c
===================================================================
--- php/php-src/branches/PHP_5_3/ext/standard/basic_functions.c 2011-08-07 
13:10:10 UTC (rev 314421)
+++ php/php-src/branches/PHP_5_3/ext/standard/basic_functions.c 2011-08-07 
13:19:04 UTC (rev 314422)
@@ -4313,15 +4313,15 @@
                /* the first <len> slots are filled by the one short ops
                 * we now extend our array and jump to the new added structs */
                opts = (opt_struct *) erealloc(opts, sizeof(opt_struct) * (len 
+ count + 1));
+               if (!opts) {
+                       RETURN_FALSE;
+               }
+
                orig_opts = opts;
                opts += len;

                memset(opts, 0, count * sizeof(opt_struct));

-               if (!opts) {
-                       RETURN_FALSE;
-               }
-
                /* Reset the array indexes. */
                zend_hash_internal_pointer_reset(Z_ARRVAL_P(p_longopts));

@@ -4358,6 +4358,10 @@
                }
        } else {
                opts = (opt_struct*) erealloc(opts, sizeof(opt_struct) * (len + 
1));
+               if (!opts) {
+                       RETURN_FALSE;
+               }
+
                orig_opts = opts;
                opts += len;
        }

Modified: php/php-src/branches/PHP_5_4/ext/standard/basic_functions.c
===================================================================
--- php/php-src/branches/PHP_5_4/ext/standard/basic_functions.c 2011-08-07 
13:10:10 UTC (rev 314421)
+++ php/php-src/branches/PHP_5_4/ext/standard/basic_functions.c 2011-08-07 
13:19:04 UTC (rev 314422)
@@ -4252,15 +4252,15 @@
                /* the first <len> slots are filled by the one short ops
                 * we now extend our array and jump to the new added structs */
                opts = (opt_struct *) erealloc(opts, sizeof(opt_struct) * (len 
+ count + 1));
+               if (!opts) {
+                       RETURN_FALSE;
+               }
+
                orig_opts = opts;
                opts += len;

                memset(opts, 0, count * sizeof(opt_struct));

-               if (!opts) {
-                       RETURN_FALSE;
-               }
-
                /* Reset the array indexes. */
                zend_hash_internal_pointer_reset(Z_ARRVAL_P(p_longopts));

@@ -4297,6 +4297,10 @@
                }
        } else {
                opts = (opt_struct*) erealloc(opts, sizeof(opt_struct) * (len + 
1));
+               if (!opts) {
+                       RETURN_FALSE;
+               }
+
                orig_opts = opts;
                opts += len;
        }

Modified: php/php-src/trunk/ext/standard/basic_functions.c
===================================================================
--- php/php-src/trunk/ext/standard/basic_functions.c    2011-08-07 13:10:10 UTC 
(rev 314421)
+++ php/php-src/trunk/ext/standard/basic_functions.c    2011-08-07 13:19:04 UTC 
(rev 314422)
@@ -4282,15 +4282,15 @@
                /* the first <len> slots are filled by the one short ops
                 * we now extend our array and jump to the new added structs */
                opts = (opt_struct *) erealloc(opts, sizeof(opt_struct) * (len 
+ count + 1));
+               if (!opts) {
+                       RETURN_FALSE;
+               }
+
                orig_opts = opts;
                opts += len;

                memset(opts, 0, count * sizeof(opt_struct));

-               if (!opts) {
-                       RETURN_FALSE;
-               }
-
                /* Reset the array indexes. */
                zend_hash_internal_pointer_reset(Z_ARRVAL_P(p_longopts));

@@ -4327,6 +4327,10 @@
                }
        } else {
                opts = (opt_struct*) erealloc(opts, sizeof(opt_struct) * (len + 
1));
+               if (!opts) {
+                       RETURN_FALSE;
+               }
+
                orig_opts = opts;
                opts += len;
        }

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to