com php-src: #74337 pointer returned by php_stream_fopen_ tmpfile not validated in memory.c: main/streams/m emory.c
[email protected] (Anatol Belski)
| Newsgroups | php.cvs |
|---|---|
| Message-ID | <[email protected]> |
Commit: 793a8bd886bc0cb7754b0d824406b538b4069fc3 Author: Anton Serbulov <[email protected]> Fri, 14 Apr 2017 15:26:13 +0700 Committer: Anatol Belski <[email protected]> Sat, 22 Apr 2017 21:56:37 +0200 Parents: 9b7f13cb1b750d2dcac441945ab7cc1600fc080b Branches: PHP-7.0 PHP-7.1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=793a8bd886bc0cb7754b0d824406b538b4069fc3 Log: #74337 pointer returned by php_stream_fopen_tmpfile not validated in memory.c Bugs: https://bugs.php.net/74337 Changed paths: M main/streams/memory.c Diff: diff --git a/main/streams/memory.c b/main/streams/memory.c index 6e3d1dd..f4fd6a8 100644 --- a/main/streams/memory.c +++ b/main/streams/memory.c @@ -501,9 +501,14 @@ static int php_stream_temp_cast(php_stream *stream, int castas, void **ret) return FAILURE; } + file = php_stream_fopen_tmpfile(); + if (file == NULL) { + php_error_docref(NULL, E_WARNING, "Unable to create temporary file."); + return FAILURE; + } + /* perform the conversion and then pass the request on to the innerstream */ membuf = php_stream_memory_get_buffer(ts->innerstream, &memsize); - file = php_stream_fopen_tmpfile(); php_stream_write(file, membuf, memsize); pos = php_stream_tell(ts->innerstream);