Skip to content

Commit 66e2aa7

Browse files
authored
Fix use-of-uninitialized-value when calling php_posix_stream_get_fd (#11694)
Passing a double pointer to php_stream_cast means the caller of php_posix_stream_get_fd will never receive the actual value. Moreover, php_posix_stream_get_fd may only write the low sizeof(php_socket_t) bytes of fd, so we need to initialize the upper bytes to 0 to avoid partial use-of-uninitialized-value.
1 parent 0313640 commit 66e2aa7

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

ext/posix/posix.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -432,9 +432,9 @@ static int php_posix_stream_get_fd(zval *zfp, zend_long *fd) /* {{{ */
432432
* It is only used here so that the buffered data warning is not displayed.
433433
*/
434434
if (php_stream_can_cast(stream, PHP_STREAM_AS_FD_FOR_SELECT | PHP_STREAM_CAST_INTERNAL) == SUCCESS) {
435-
php_stream_cast(stream, PHP_STREAM_AS_FD_FOR_SELECT | PHP_STREAM_CAST_INTERNAL, (void*)&fd, 0);
435+
php_stream_cast(stream, PHP_STREAM_AS_FD_FOR_SELECT | PHP_STREAM_CAST_INTERNAL, (void*)fd, 0);
436436
} else if (php_stream_can_cast(stream, PHP_STREAM_AS_FD | PHP_STREAM_CAST_INTERNAL) == SUCCESS) {
437-
php_stream_cast(stream, PHP_STREAM_AS_FD | PHP_STREAM_CAST_INTERNAL, (void*)&fd, 0);
437+
php_stream_cast(stream, PHP_STREAM_AS_FD | PHP_STREAM_CAST_INTERNAL, (void*)fd, 0);
438438
} else {
439439
php_error_docref(NULL, E_WARNING, "Could not use stream of type '%s'",
440440
stream->ops->label);
@@ -449,7 +449,7 @@ PHP_FUNCTION(posix_ttyname)
449449
{
450450
zval *z_fd;
451451
char *p;
452-
zend_long fd;
452+
zend_long fd = 0;
453453
#if defined(ZTS) && defined(HAVE_TTYNAME_R) && defined(_SC_TTY_NAME_MAX)
454454
zend_long buflen;
455455
#endif
@@ -502,7 +502,7 @@ PHP_FUNCTION(posix_ttyname)
502502
PHP_FUNCTION(posix_isatty)
503503
{
504504
zval *z_fd;
505-
zend_long fd;
505+
zend_long fd = 0;
506506

507507
ZEND_PARSE_PARAMETERS_START(1, 1)
508508
Z_PARAM_ZVAL(z_fd)
@@ -1272,7 +1272,7 @@ PHP_FUNCTION(posix_pathconf)
12721272

12731273
PHP_FUNCTION(posix_fpathconf)
12741274
{
1275-
zend_long name, ret, fd;
1275+
zend_long name, ret, fd = 0;
12761276
zval *z_fd;
12771277

12781278
ZEND_PARSE_PARAMETERS_START(2, 2)

0 commit comments

Comments
 (0)