Fixed bug #61461 (missing checks around malloc() calls).

1 files changed, 10 insertions, 0 deletions

diff --git a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c
index 88f5d78d20..79ccea37d7 100644
--- a/sapi/cli/php_cli_server.c
+++ b/sapi/cli/php_cli_server.c
@@ -1281,6 +1281,10 @@ static void php_cli_server_request_translate_vpath(php_cli_server_request *reque
 	size_t prev_patch_len;
 	int  is_static_file = 0;
 
+	if (!buf) {
+		return;
+	}
+
 	memmove(p, document_root, document_root_len);
 	p += document_root_len;
 	vpath = p;
@@ -1536,6 +1540,9 @@ static int php_cli_server_client_read_request_on_body(php_http_parser *parser, c
 	php_cli_server_client *client = parser->data;
 	if (!client->request.content) {
 		client->request.content = pemalloc(parser->content_length, 1);
+		if (!client->request.content) {
+			return -1;
+		}
 		client->request.content_len = 0;
 	}
 	memmove(client->request.content + client->request.content_len, at, length);
@@ -1606,6 +1613,9 @@ static int php_cli_server_client_read_request(php_cli_server_client *client, cha
 	}
 	if (client->current_header_name) {
 		char *header_name = safe_pemalloc(client->current_header_name_len, 1, 1, 1);
+		if (!header_name) {
+			return -1;
+		}
 		memmove(header_name, client->current_header_name, client->current_header_name_len);
 		client->current_header_name = header_name;
 		client->current_header_name_allocated = 1;