Skip to content

Commit 35fd97c

Browse files
committed
Fix GH-9033: Loading blacklist file can fail due to negative length
If the blacklist file contains a line with a single double-quote, we called `zend_strndup(pbuf, -1)` what causes an unnecessary bail out; instead we just ignore that line. If the blacklist file contains an empty line, we may have caused an OOB read; instead we just ignore that line. Closes GH-9036.
1 parent 44b86ae commit 35fd97c

File tree

2 files changed

+6
-2
lines changed

2 files changed

+6
-2
lines changed

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ PHP NEWS
55
- DBA:
66
. Fixed LMDB driver memory leak on DB creation failure (Girgias)
77

8+
- OPcache:
9+
. Fixed bug GH-9033 (Loading blacklist file can fail due to negative length).
10+
(cmb)
11+
812
- Standard:
913
. Fixed bug GH-9017 (php_stream_sock_open_from_socket could return NULL).
1014
(Heiko Weber)

ext/opcache/zend_accelerator_blacklist.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -276,12 +276,12 @@ static void zend_accel_blacklist_loadone(zend_blacklist *blacklist, char *filena
276276
}
277277

278278
/* strip \" */
279-
if (pbuf[0] == '\"' && pbuf[path_length - 1]== '\"') {
279+
if (path_length > 0 && pbuf[0] == '\"' && pbuf[path_length - 1]== '\"') {
280280
*pbuf++ = 0;
281281
path_length -= 2;
282282
}
283283

284-
if (path_length == 0) {
284+
if (path_length <= 0) {
285285
continue;
286286
}
287287

0 commit comments

Comments
 (0)