Skip to content

Fix GH-14639: Member access within null pointer in ext/spl/spl_observer.c - #14849

Closed
ndossche wants to merge 1 commit into
php:PHP-8.2from
ndossche:spl-14639
Closed

ndossche wants to merge 1 commit into
php:PHP-8.2from
ndossche:spl-14639

Conversation

@ndossche

@ndossche ndossche commented Jul 6, 2024

Copy link
Copy Markdown
Member

spl_object_storage_attach_handle creates an entry already, but only fills it in at the end with spl_object_storage_create_element which allocates memory. In this case the allocation fails and we're left with a NULL slot. Doing the allocation first isn't an option because we want to check whether the slot is occupied before allocating memory. The simplest solution is to set the entry to NULL and check for a NULL pointer upon destruction.

@ndossche
ndossche requested a review from Girgias as a code owner July 6, 2024 20:48
@ndossche ndossche linked an issue Jul 6, 2024 that may be closed by this pull request
…erver.c

`spl_object_storage_attach_handle` creates an entry already, but only
fills it in at the end with `spl_object_storage_create_element` which
allocates memory. In this case the allocation fails and we're left with
a NULL slot. Doing the allocation first isn't an option because we want
to check whether the slot is occupied before allocating memory.
The simplest solution is to set the entry to NULL and check for a NULL
pointer upon destruction.

@Girgias Girgias left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, these memory bailout issues are somewhat annoying :/

@ndossche

ndossche commented Jul 6, 2024

Copy link
Copy Markdown
Member Author

LGTM, these memory bailout issues are somewhat annoying :/

Yeah we seem to hit them a lot lately. And they're a pain to debug (like that Curl one)

@ndossche ndossche closed this in 0d4e0c0 Jul 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Member access within null pointer in ext/spl/spl_observer.c

2 participants