further initialisation type check and segfault fix.

Author: devnexen

ext/snmp/snmp.c

@@ -832,7 +832,7 @@ static bool php_snmp_parse_oid(
 /* {{{ snmp_session_init
 	allocates memory for session and session->peername, caller should free it manually using session_free() and efree()
 */
-static bool snmp_session_init(php_snmp_session **session_p, int version, zend_string *hostname, zend_string *community, int timeout, int retries)
+static bool snmp_session_init(php_snmp_session **session_p, int version, zend_string *hostname, zend_string *community, zend_long timeout, zend_long retries)
 {
 	php_snmp_session *session;
 	char *pptr, *host_ptr;
@@ -841,11 +841,23 @@ static bool snmp_session_init(php_snmp_session **session_p, int version, zend_st
 	struct sockaddr **psal;
 	struct sockaddr **res;
 
+	*session_p = 0;
+
 	if (ZSTR_LEN(hostname) >= MAX_NAME_LEN) {
 		zend_value_error("hostname length must be lower than %d", MAX_NAME_LEN);
 		return false;
 	}
 
+	if (timeout < -1 || timeout > LONG_MAX) {
+		zend_value_error("timeout must be between -1 and %ld", LONG_MAX);
+		return false;
+	}
+
+	if (retries < -1 || retries > INT_MAX) {
+		zend_value_error("retries must be between -1 and %d", INT_MAX);
+		return false;
+	}
+
 	// TODO: Do not strip and re-add the port in peername?
 	unsigned short remote_port = SNMP_PORT;
 	int tmp_port;
@@ -856,7 +868,7 @@ static bool snmp_session_init(php_snmp_session **session_p, int version, zend_st
 
 	snmp_sess_init(session);
 
-	session->version = version;
+	session->version = (long)version;
 
 	session->peername = emalloc(MAX_NAME_LEN);
 	/* we copy original hostname for further processing */
@@ -954,8 +966,8 @@ static bool snmp_session_init(php_snmp_session **session_p, int version, zend_st
 		session->community_len = ZSTR_LEN(community);
 	}
 
-	session->retries = retries;
-	session->timeout = timeout;
+	session->retries = (int)retries;
+	session->timeout = (long)timeout;
 	return true;
 }
 /* }}} */

ext/snmp/tests/snmp_session_error.phpt

@@ -28,10 +28,22 @@ try {
 } catch (\ValueError $e) {
 	echo $e->getMessage(), PHP_EOL;
 }
+try {
+	new SNMP(SNMP::VERSION_1, "$hostname:$port", $community, PHP_INT_MAX, $retries);
+} catch (\ValueError $e) {
+	echo $e->getMessage(), PHP_EOL;
+}
+try {
+	new SNMP(SNMP::VERSION_1, "$hostname:$port", $community, $timeout, PHP_INT_MAX);
+} catch (\ValueError $e) {
+	echo $e->getMessage(), PHP_EOL;
+}
 echo "OK";
 ?>
---EXPECT--
+--EXPECTF--
 remote port must be between 0 and 65535
 remote port must be between 0 and 65535
 hostname length must be lower than 128
+timeout must be between 0 and %d
+retries must be between 0 and %d
 OK