From 955ecadf93ffb76efef60f84a582dc41282895e9 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Thu, 16 Jul 2026 09:15:28 -0400 Subject: [PATCH] ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED php_filter_encode_url() initialized its 256-byte "must encode" table with memset(tmp, 1, sizeof(tmp) - 1), leaving tmp[255] uninitialized. Whether 0xFF got percent-encoded then depended on stack garbage; valgrind reports the read as a conditional jump on an uninitialised value. Initialize the whole table. Closes GH-22762 --- ext/filter/sanitizing_filters.c | 2 +- ext/filter/tests/filter_sanitize_encoded_0xff.phpt | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 ext/filter/tests/filter_sanitize_encoded_0xff.phpt diff --git a/ext/filter/sanitizing_filters.c b/ext/filter/sanitizing_filters.c index 647d559c1df5..a356722765be 100644 --- a/ext/filter/sanitizing_filters.c +++ b/ext/filter/sanitizing_filters.c @@ -68,7 +68,7 @@ static void php_filter_encode_url(zval *value, const unsigned char* chars, const unsigned char *e = s + char_len; zend_string *str; - memset(tmp, 1, sizeof(tmp)-1); + memset(tmp, 1, sizeof(tmp)); while (s < e) { tmp[*s++] = '\0'; diff --git a/ext/filter/tests/filter_sanitize_encoded_0xff.phpt b/ext/filter/tests/filter_sanitize_encoded_0xff.phpt new file mode 100644 index 000000000000..1ee61aba7b70 --- /dev/null +++ b/ext/filter/tests/filter_sanitize_encoded_0xff.phpt @@ -0,0 +1,12 @@ +--TEST-- +FILTER_SANITIZE_ENCODED percent-encodes 0xFF +--EXTENSIONS-- +filter +--FILE-- + +--EXPECT-- +string(3) "%FF" +string(10) "%FE%FF%00A"