Skip to content

Fix freeing uninitialized memory in LDAP sort control parsing #22342

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
iliaal wants to merge 1 commit into
base: PHP-8.4
Choose a base branch
from
+31 −0
Open

Fix freeing uninitialized memory in LDAP sort control parsing #22342

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ext/ldap/ldap.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -564,6 +564,7 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra

num_keys = zend_hash_num_elements(Z_ARRVAL_P(val));
sort_keys = safe_emalloc((num_keys+1), sizeof(LDAPSortKey*), 0);
memset(sort_keys, 0, (num_keys+1) * sizeof(LDAPSortKey*));
tmpstrings1 = safe_emalloc(num_keys, sizeof(zend_string*), 0);
tmpstrings2 = safe_emalloc(num_keys, sizeof(zend_string*), 0);
num_tmpstrings1 = 0;
Expand Down
30 changes: 30 additions & 0 deletions ext/ldap/tests/ldap_sort_control_missing_attr.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
--TEST--
ldap_search(): malformed sort control (sort key missing "attr") must not free uninitialized memory
--EXTENSIONS--
ldap
--FILE--
<?php
// No server needed: the control array is validated before the search is sent.
// A sort key missing "attr" makes php_ldap_control_from_array() bail mid-loop;
// the failure cleanup must not walk/free the partially built sort_keys array.
$ld = ldap_connect("ldap://127.0.0.1:389");

try {
ldap_search($ld, "dc=example,dc=com", "(objectClass=*)", [], 0, -1, -1, LDAP_DEREF_NEVER, [
[
'oid' => LDAP_CONTROL_SORTREQUEST,
'value' => [
['attr' => 'cn'],
['reverse' => true],
],
],
]);
} catch (\ValueError $e) {
echo $e->getMessage(), "\n";
}

echo "ok\n";
?>
--EXPECT--
ldap_search(): Sort key list must have an "attr" key
ok
Loading