[php-src] Issue #23453: ext/snmp: Attempted free on non-malloced address

[email protected] (alexandre-daubois)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/23453
Author: alexandre-daubois

### Description

The following code:

```c
$session = new SNMP(SNMP::VERSION_3, 'localhost', 'user');
$session->setSecurity(
    'authPriv', 'SHA', 'authpassword12345', 'AES', 'privpassword12345',
    'myContext', str_repeat('aa', 33)  // 66 hex chars = 33 bytes > 32-byte buffer
);
```

Produces an ASan error:

```
=================================================================
==41704==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x00010c64d440 in thread T0
    #0 0x000104fb5350 in realloc+0x80 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x41350)
    #1 0x000104855348 in snmp_realloc+0x4c (libnetsnmp.45.dylib:arm64+0x29348)
    #2 0x000104855b38 in netsnmp_hex_to_binary+0xf8 (libnetsnmp.45.dylib:arm64+0x29b38)
    #3 0x0001030f8ebc in snmp_session_set_security snmp.c:1210
    #4 0x0001030f87cc in zim_SNMP_setSecurity snmp.c:1751
    #5 0x000103703830 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_TAILCALL_HANDLER zend_vm_execute.h
    #6 0x00010355b034 in execute_ex zend_vm_execute.h:110551
    #7 0x00010355b790 in zend_execute zend_vm_execute.h:115989
    #8 0x00010390a280 in zend_execute_script zend.c:1980
    #9 0x00010331c58c in php_execute_script_ex main.c:2589
    #10 0x00010390f664 in do_cli php_cli.c:933
    #11 0x00010390d08c in do_php_cli php_cli.c:1346
    #12 0x000189c884e0 in start+0x1b4c (dyld:arm64e+0x204e0)

Address 0x00010c64d440 is a wild pointer inside of access range of size 0x000000000001.
SUMMARY: AddressSanitizer: bad-free (libnetsnmp.45.dylib:arm64+0x29348) in snmp_realloc+0x4c
==41704==ABORTING
```

`contextEngineID` is a `SnmpEngineID` type as defined by [RFC 3411](https://datatracker.ietf.org/doc/html/rfc3411#section-5), and its length must be between 5 and 32 bytes. We should process the value gracefully.

### PHP Version

```plain
All maintained versions
```

### Operating System

_No response_
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.