Skip to content

Commit 3a44c78

Browse files
nielsdosdevnexen
authored andcommitted
Fix null pointer dereference of param
When the validation logic for param->type was added, the logic did not account for the case where param could be NULL. The existing code did take that into account as can be seen in the `if (param)` check below. Furthermore, phpdbg_set_breakpoint_expression even calls phpdbg_create_conditional_break with param == NULL. Fix it by placing the validation logic inside a NULL check.
1 parent e217138 commit 3a44c78

File tree

2 files changed

+15
-12
lines changed

2 files changed

+15
-12
lines changed

NEWS

+1
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ PHP NEWS
2929

3030
- PHPDBG:
3131
. Fix undefined behaviour in phpdbg_load_module_or_extension(). (nielsdos)
32+
. Fix NULL pointer dereference in phpdbg_create_conditional_breal(). (nielsdos)
3233

3334
- TSRM:
3435
. Fixed Windows shmget() wrt. IPC_PRIVATE. (Tyson Andre)

sapi/phpdbg/phpdbg_bp.c

+14-12
Original file line numberDiff line numberDiff line change
@@ -829,19 +829,21 @@ static inline void phpdbg_create_conditional_break(phpdbg_breakcond_t *brake, co
829829
uint32_t cops = CG(compiler_options);
830830
zend_string *bp_code;
831831

832-
switch (param->type) {
833-
case STR_PARAM:
834-
case NUMERIC_FUNCTION_PARAM:
835-
case METHOD_PARAM:
836-
case NUMERIC_METHOD_PARAM:
837-
case FILE_PARAM:
838-
case ADDR_PARAM:
839-
/* do nothing */
840-
break;
832+
if (param) {
833+
switch (param->type) {
834+
case STR_PARAM:
835+
case NUMERIC_FUNCTION_PARAM:
836+
case METHOD_PARAM:
837+
case NUMERIC_METHOD_PARAM:
838+
case FILE_PARAM:
839+
case ADDR_PARAM:
840+
/* do nothing */
841+
break;
841842

842-
default:
843-
phpdbg_error("Invalid parameter type for conditional breakpoint");
844-
return;
843+
default:
844+
phpdbg_error("Invalid parameter type for conditional breakpoint");
845+
return;
846+
}
845847
}
846848

847849
PHPDBG_BREAK_INIT(new_break, PHPDBG_BREAK_COND);

0 commit comments

Comments
 (0)