[Libguestfs] [PATCH 3/4] php: fix invalid memory access with stringlist params

Pino Toscano ptoscano at redhat.com
Tue Feb 10 15:42:54 UTC 2015


Make sure to copy the strings we add to the char** array, otherwise they
are stale pointers which we'll try to free later.

Also, properly destruct the temporary zval.
---
 generator/php.ml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/generator/php.ml b/generator/php.ml
index 69f627f..28903d0 100644
--- a/generator/php.ml
+++ b/generator/php.ml
@@ -113,7 +113,8 @@ get_stringlist (zval *val)
     zval t = **d;
     zval_copy_ctor (&t);
     convert_to_string (&t);
-    ret[c] = Z_STRVAL (t);
+    ret[c] = estrndup (Z_STRVAL(t), Z_STRLEN (t));
+    zval_dtor (&t);
     c++;
   }
   ret[c] = NULL;
-- 
1.9.3




More information about the Libguestfs mailing list