Skip to content

Commit 317dfab

Browse files
committed
Fix memcpy null arg UB
1 parent ed2a242 commit 317dfab

File tree

1 file changed

+10
-4
lines changed

1 file changed

+10
-4
lines changed

ext/standard/http.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -130,8 +130,10 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr,
130130
p += key_prefix_len;
131131
}
132132

133-
memcpy(p, num_prefix, num_prefix_len);
134-
p += num_prefix_len;
133+
if (num_prefix) {
134+
memcpy(p, num_prefix, num_prefix_len);
135+
p += num_prefix_len;
136+
}
135137

136138
memcpy(p, ekey, ekey_len);
137139
p += ekey_len;
@@ -162,7 +164,9 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr,
162164
smart_str_appendl(formstr, arg_sep, arg_sep_len);
163165
}
164166
/* Simple key=value */
165-
smart_str_appendl(formstr, key_prefix, key_prefix_len);
167+
if (key_prefix) {
168+
smart_str_appendl(formstr, key_prefix, key_prefix_len);
169+
}
166170
if (key) {
167171
zend_string *ekey;
168172
if (enc_type == PHP_QUERY_RFC3986) {
@@ -179,7 +183,9 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr,
179183
}
180184
smart_str_append_long(formstr, idx);
181185
}
182-
smart_str_appendl(formstr, key_suffix, key_suffix_len);
186+
if (key_suffix) {
187+
smart_str_appendl(formstr, key_suffix, key_suffix_len);
188+
}
183189
smart_str_appendl(formstr, "=", 1);
184190
switch (Z_TYPE_P(zdata)) {
185191
case IS_STRING: {

0 commit comments

Comments
 (0)