Skip to content

Commit 8e7789d

Browse files
committed
Add a unlink check for php_stream_bucket_unlink
This is in the same spirit as php#13943: low-hanging, not in a hot-path, trivial, removing a limited-linear-write → arbitrary-write primitive, … moreover, given how many filters are available, having some low-hanging hardening there shouldn't hurt. cc @arnaud-lb
1 parent 8cf8751 commit 8e7789d

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

main/streams/filter.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,11 +192,17 @@ PHPAPI void php_stream_bucket_append(php_stream_bucket_brigade *brigade, php_str
192192
PHPAPI void php_stream_bucket_unlink(php_stream_bucket *bucket)
193193
{
194194
if (bucket->prev) {
195+
if (bucket->prev->next != bucket) {
196+
zend_error_noreturn(E_ERROR, "Stream bucket list corruption.");
197+
}
195198
bucket->prev->next = bucket->next;
196199
} else if (bucket->brigade) {
197200
bucket->brigade->head = bucket->next;
198201
}
199202
if (bucket->next) {
203+
if (bucket->next->prev != bucket) {
204+
zend_error_noreturn(E_ERROR, "Stream bucket list corruption.");
205+
}
200206
bucket->next->prev = bucket->prev;
201207
} else if (bucket->brigade) {
202208
bucket->brigade->tail = bucket->prev;

0 commit comments

Comments
 (0)