Skip to content

ext/snmp: fix infinite loop in snprint_value retry when val_len is zero #21342

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
somethingwithproof wants to merge 1 commit into from
+9 −0
Closed

ext/snmp: fix infinite loop in snprint_value retry when val_len is zero #21342

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions ext/snmp/snmp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,6 +243,15 @@ static void php_snmp_getvalue(struct variable_list *vars, zval *snmpval, int val

/* use emalloc() for large values, use static array otherwise */

/* Ensure val_len is at least sizeof(sbuf) so doubling will grow beyond
* the initial stack buffer. Without this, a zero val_len would cause
* val_len *= 2 to remain zero indefinitely, never reaching the 512k
* break condition.
*/
if (val_len < (int)sizeof(sbuf)) {
val_len = sizeof(sbuf);
}

/* There is no way to know the size of buffer snprint_value() needs in order to print a value there.
* So we are forced to probe it
*/
Expand Down
Loading