php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2' into PHP-8.3

Browse Source 
* PHP-8.2:
  Fix various memory leaks in curl mime handling
This commit is contained in:
Niels Dossche
2024-11-26 20:37:51 +01:00
parent 02b1056714 a80f0b515a
commit 89060216a3
2 changed files with 25 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@@ -18,6 +18,7 @@ PHP NEWS
- Curl:
. Fixed bug GH-16802 (open_basedir bypass using curl extension). (nielsdos)
. Fix various memory leaks in curl mime handling. (nielsdos)
- DOM:
. Fixed bug GH-16777 (Calling the constructor again on a DOM object after it

39
ext/curl/interface.c
View File

@@ -1443,7 +1443,7 @@ static inline zend_result build_mime_structure_from_hash(php_curl *ch, zval *zpo
postval = Z_STR_P(prop);
if (php_check_open_basedir(ZSTR_VAL(postval))) {
return FAILURE;
goto out_string;
}
prop = zend_read_property(curl_CURLFile_class, Z_OBJ_P(current), "mime", sizeof("mime")-1, 0, &rv);
@@ -1469,15 +1469,18 @@ static inline zend_result build_mime_structure_from_hash(php_curl *ch, zval *zpo
seekfunc = NULL;
}
part = curl_mime_addpart(mime);
if (part == NULL) {
if (stream) {
php_stream_close(stream);
}
goto out_string;
}
cb_arg = emalloc(sizeof *cb_arg);
cb_arg->filename = zend_string_copy(postval);
cb_arg->stream = stream;
part = curl_mime_addpart(mime);
if (part == NULL) {
zend_string_release_ex(string_key, 0);
return FAILURE;
}
if ((form_error = curl_mime_name(part, ZSTR_VAL(string_key))) != CURLE_OK
|| (form_error = curl_mime_data_cb(part, filesize, read_cb, seekfunc, free_cb, cb_arg)) != CURLE_OK
|| (form_error = curl_mime_filename(part, filename ? filename : ZSTR_VAL(postval))) != CURLE_OK
@@ -1511,8 +1514,7 @@ static inline zend_result build_mime_structure_from_hash(php_curl *ch, zval *zpo
prop = zend_read_property(curl_CURLStringFile_class, Z_OBJ_P(current), "postname", sizeof("postname")-1, 0, &rv);
if (EG(exception)) {
zend_string_release_ex(string_key, 0);
return FAILURE;
goto out_string;
}
ZVAL_DEREF(prop);
ZEND_ASSERT(Z_TYPE_P(prop) == IS_STRING);
@@ -1521,8 +1523,7 @@ static inline zend_result build_mime_structure_from_hash(php_curl *ch, zval *zpo
prop = zend_read_property(curl_CURLStringFile_class, Z_OBJ_P(current), "mime", sizeof("mime")-1, 0, &rv);
if (EG(exception)) {
zend_string_release_ex(string_key, 0);
return FAILURE;
goto out_string;
}
ZVAL_DEREF(prop);
ZEND_ASSERT(Z_TYPE_P(prop) == IS_STRING);
@@ -1531,8 +1532,7 @@ static inline zend_result build_mime_structure_from_hash(php_curl *ch, zval *zpo
prop = zend_read_property(curl_CURLStringFile_class, Z_OBJ_P(current), "data", sizeof("data")-1, 0, &rv);
if (EG(exception)) {
zend_string_release_ex(string_key, 0);
return FAILURE;
goto out_string;
}
ZVAL_DEREF(prop);
ZEND_ASSERT(Z_TYPE_P(prop) == IS_STRING);
@@ -1545,8 +1545,7 @@ static inline zend_result build_mime_structure_from_hash(php_curl *ch, zval *zpo
part = curl_mime_addpart(mime);
if (part == NULL) {
zend_string_release_ex(string_key, 0);
return FAILURE;
goto out_string;
}
if ((form_error = curl_mime_name(part, ZSTR_VAL(string_key))) != CURLE_OK
|| (form_error = curl_mime_data(part, ZSTR_VAL(postval), ZSTR_LEN(postval))) != CURLE_OK
@@ -1602,7 +1601,7 @@ static inline zend_result build_mime_structure_from_hash(php_curl *ch, zval *zpo
SAVE_CURL_ERROR(ch, error);
if (error != CURLE_OK) {
return FAILURE;
goto out_mime;
}
if ((*ch->clone) == 1) {
@@ -1618,6 +1617,16 @@ static inline zend_result build_mime_structure_from_hash(php_curl *ch, zval *zpo
SAVE_CURL_ERROR(ch, error);
return error == CURLE_OK ? SUCCESS : FAILURE;
out_string:
zend_string_release_ex(string_key, false);
out_mime:
#if LIBCURL_VERSION_NUM >= 0x073800 /* 7.56.0 */
curl_mime_free(mime);
#else
curl_formfree(first);
#endif
return FAILURE;
}
/* }}} */