- Fixed bug #53136 (Invalid read on openssl_csr_new())

diff --git a/NEWS b/NEWS
index 9a380614ce0fa729d48e324a7f798833f4d8314b..a16929ba1b955b3379ddf0ad8dc481e19733240e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -81,6 +81,7 @@
 - Fixed bug #53144 (Segfault in SplObjectStorage::removeAll()). (Felipe)
 - Fixed bug #53141 (autoload misbehaves if called from closing session).
   (ladislav at marek dot su)
+- Fixed bug #53136 (Invalid read on openssl_csr_new()). (Felipe)
 - Fixed bug #53071 (SPLObjectStorage defeats gc_collect_cycles). (Gustavo)
 - Fixed bug #53006 (stream_get_contents has an unpredictable behavior when the
   underlying stream does not support seeking). (Gustavo)

diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
index a9806ceae2af25f495db41f889672b73ac7edda6..0440aa7d16dfddba516630b1dd6df7c24c519fed 100644 (file)
--- a/ext/openssl/openssl.c
+++ b/ext/openssl/openssl.c
@@ -2117,7 +2117,8 @@ static int php_openssl_make_REQ(struct php_x509_request * req, X509_REQ * csr, z
                if (attribs) {
                        zend_hash_internal_pointer_reset_ex(HASH_OF(attribs), &hpos);
                        while(zend_hash_get_current_data_ex(HASH_OF(attribs), (void**)&item, &hpos) == SUCCESS) {
-                               char * strindex; uint strindexlen;
+                               char *strindex = NULL;
+                               uint strindexlen;
                                ulong intindex;
 
                                zend_hash_get_current_key_ex(HASH_OF(attribs), &strindex, &strindexlen, &intindex, 0, &hpos);