Fix a possible null-pointer dereference in cookies encryption

1 files changed, 5 insertions, 0 deletions

diff --git a/src/sp_crypt.c b/src/sp_crypt.c
index 6d48554..9d4e6bb 100644
--- a/src/sp_crypt.c
+++ b/src/sp_crypt.c
@@ -42,6 +42,11 @@ int decrypt_zval(zval *pDest, bool simulation, zend_hash_key *hash_key) {
 
   zend_string *debase64 = php_base64_decode((unsigned char *)(Z_STRVAL_P(pDest)), Z_STRLEN_P(pDest));
 
+  if (!debase64) {
+      sp_log_drop( "cookie_encryption", "Unable to base64-decode the cookie");
+      return ZEND_HASH_APPLY_REMOVE;
+  }
+
   if (ZSTR_LEN(debase64) < crypto_secretbox_NONCEBYTES) {
     if (true == simulation) {
       sp_log_simulation(