Skip to content

ext/standard/dns.c: drop partially built records in php_parserr() #25282

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Marti2203 wants to merge 2 commits into from
+14 −8
Closed

ext/standard/dns.c: drop partially built records in php_parserr() #25282

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
123d85d
ext/standard/dns.c: drop partially built records in php_parserr()
Marti2203 Nov 7, 2026
5bd7c58
ext/standard/dns.c: use a goto for the php_parserr() failure path
Marti2203 Nov 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 14 additions & 8 deletions ext/standard/dns.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -441,7 +441,7 @@ PHP_FUNCTION(dns_check_record)

#define CHECKCP(n) do { \
if (cp + n > end) { \
return NULL; \
goto fail; \
} \
} while (0)

Expand Down Expand Up @@ -528,7 +528,7 @@ static uint8_t *php_parserr(uint8_t *cp, uint8_t *end, querybuf *answer, int typ
}
n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2);
if (n < 0) {
return NULL;
goto fail;
}
cp += n;
add_assoc_string(subarray, "target", name);
Expand Down Expand Up @@ -565,7 +565,7 @@ static uint8_t *php_parserr(uint8_t *cp, uint8_t *end, querybuf *answer, int typ
add_assoc_stringl(subarray, "tag", (char*)cp, n);
cp += n;
if ( (size_t) dlen < ((size_t)n) + 2 ) {
return NULL;
goto fail;
}
n = dlen - n - 2;
CHECKCP(n);
Expand Down Expand Up @@ -608,13 +608,13 @@ static uint8_t *php_parserr(uint8_t *cp, uint8_t *end, querybuf *answer, int typ
add_assoc_string(subarray, "type", "SOA");
n = dn_expand(answer->qb2, end, cp, name, (sizeof name) -2);
if (n < 0) {
return NULL;
goto fail;
}
cp += n;
add_assoc_string(subarray, "mname", name);
n = dn_expand(answer->qb2, end, cp, name, (sizeof name) -2);
if (n < 0) {
return NULL;
goto fail;
}
cp += n;
add_assoc_string(subarray, "rname", name);
Expand Down Expand Up @@ -735,7 +735,7 @@ static uint8_t *php_parserr(uint8_t *cp, uint8_t *end, querybuf *answer, int typ
if (cp < p + dlen) {
n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2);
if (n < 0) {
return NULL;
goto fail;
}
cp += n;
add_assoc_string(subarray, "chain", name);
Expand All @@ -752,7 +752,7 @@ static uint8_t *php_parserr(uint8_t *cp, uint8_t *end, querybuf *answer, int typ
add_assoc_long(subarray, "port", n);
n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2);
if (n < 0) {
return NULL;
goto fail;
}
cp += n;
add_assoc_string(subarray, "target", name);
Expand Down Expand Up @@ -788,7 +788,7 @@ static uint8_t *php_parserr(uint8_t *cp, uint8_t *end, querybuf *answer, int typ

n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2);
if (n < 0) {
return NULL;
goto fail;
}
cp += n;
add_assoc_string(subarray, "replacement", name);
Expand All @@ -801,6 +801,12 @@ static uint8_t *php_parserr(uint8_t *cp, uint8_t *end, querybuf *answer, int typ
}

return cp;

fail:
/* Drop the partially built record, so that the caller does not publish it. */
zval_ptr_dtor(subarray);
ZVAL_UNDEF(subarray);
return NULL;
}
/* }}} */

Expand Down
Loading