Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SEGV in bindtextdomain #17400

Open
YuanchengJiang opened this issue Jan 8, 2025 · 0 comments · May be fixed by #17402
Open

SEGV in bindtextdomain #17400

YuanchengJiang opened this issue Jan 8, 2025 · 0 comments · May be fixed by #17402
Assignees
@devnexen
Labels
Bug Extension: gettext Status: Verified

Comments

@YuanchengJiang
Copy link

Description

The following code:

<?php
$utf16_first_le = pack("H*", "00d800dc");
$utf16le_char_bad = pack("H*", "00dc00dc");
bindtextdomain($utf16le_char_bad,$utf16_first_le);

Resulted in this output:

/home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gettext/gettext.c:216:2: runtime error: null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:408:33: note: nonnull attribute specified here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gettext/gettext.c:216:2

PHP Version

nightly

Operating System

No response
@devnexen devnexen self-assigned this Jan 8, 2025
devnexen added a commit to devnexen/php-src that referenced this issue Jan 8, 2025
@devnexen
Fix phpGH-17400: bindtextdomain segfault with UTF-16 domain value.
30857a1 
The provided domain could be a non ascii value even if not supposed to,
in the error reported case was of 4 code points long but domain is "empty" leading to
a NULL return. It worked up to 8.3 "by accident" before the zend_string
conversion and check prior for emptiness.
devnexen added a commit to devnexen/php-src that referenced this issue Jan 8, 2025
@devnexen
Fix phpGH-17400: bindtextdomain segfault with UTF-16 domain value.
ef4647a 
The provided domain could be a non ascii value even if not supposed to,
in the error reported case was of 4 code points long but domain is "empty" leading to
a NULL return. It worked up to 8.3 "by accident" before the zend_string
conversion and check prior for emptiness.
@devnexen devnexen linked a pull request Jan 8, 2025 that will close this issue
Fix GH-17400: bindtextdomain segfault with UTF-16 domain value. #17402
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@devnexen devnexen

Labels
Bug Extension: gettext Status: Verified
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix GH-17400: bindtextdomain segfault with UTF-16 domain value. devnexen/php-src
2 participants
@devnexen @YuanchengJiang