Skip to content

Commit b8755a7

Browse files
committed
Fix uninitialized variable accesses in sockets/conversions
This was first pointed out in GH-10959. The from_zval_... functions don't always write to the pointer, in particular it is necessary to check for an error before using the value. Otherwise we can access an uninitialized value and that's UB (and dangerous). Note: this does *NOT* get rid of the compiler warning. Even though there is error checking now, the compiler isn't smart enough to figure out that the values can not be used uninitialized. Closes GH-10966.
1 parent bb7dd51 commit b8755a7

File tree

1 file changed

+8
-1
lines changed

1 file changed

+8
-1
lines changed

ext/sockets/conversions.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -720,6 +720,10 @@ static void from_zval_write_sockaddr_aux(const zval *container,
720720
zend_llist_add_element(&ctx->keys, &node);
721721
from_zval_write_int(elem, (char*)&family, ctx);
722722
zend_llist_remove_tail(&ctx->keys);
723+
724+
if (UNEXPECTED(ctx->err.has_error)) {
725+
return;
726+
}
723727
} else {
724728
family = ctx->sock->type;
725729
}
@@ -1115,7 +1119,10 @@ static void from_zval_write_controllen(const zval *elem, char *msghdr_c, ser_con
11151119
* this least common denominator
11161120
*/
11171121
from_zval_write_uint32(elem, (char*)&len, ctx);
1118-
if (!ctx->err.has_error && len == 0) {
1122+
if (ctx->err.has_error) {
1123+
return;
1124+
}
1125+
if (len == 0) {
11191126
do_from_zval_err(ctx, "controllen cannot be 0");
11201127
return;
11211128
}

0 commit comments

Comments
 (0)