Skip to content

Copy the context name in SNMP::setSecurity() - #25205

Closed
lacatoire wants to merge 1 commit into
php:PHP-8.4from
lacatoire:fix/snmp-contextname-copy-8.4
Closed

lacatoire wants to merge 1 commit into
php:PHP-8.4from
lacatoire:fix/snmp-contextname-copy-8.4

Conversation

@lacatoire

@lacatoire lacatoire commented Nov 5, 2026 •

Copy link
Copy Markdown
Member

SNMP::setSecurity() stored a pointer into the $contextName string instead of copying it, so the next request read freed memory once the string was released. Copy it and free it with the session.

To reproduce

$s = new SNMP(SNMP::VERSION_3, '127.0.0.1', 'adminMD5AES', 500000, 1);
$ctx = str_repeat('c', 5) . random_int(10, 99);
$s->setSecurity('authPriv', 'MD5', 'test1234', 'AES', 'test1234', $ctx);
unset($ctx);
var_dump(@$s->get('.1.3.6.1.2.1.1.4.0'));

Before (ASAN build): heap-use-after-free in strdup, called from snmp_sess_add_ex

After: bool(false)

@devnexen devnexen closed this in c0e0774 Nov 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants