php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-19922: gzopen() double free

Browse Source 
close GH-19924
This commit is contained in:
David Carlier
2025-09-22 19:02:46 +01:00
parent 3ee56f68ed
commit 93bac8cb1a
3 changed files with 16 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@@ -46,6 +46,9 @@ PHP NEWS
. Fixed bug GH-19932 (Memory leak in zip setEncryptionName()/setEncryptionIndex()).
(David Carlier)
- Zlib:
. Fixed bug GH-19922 (Double free on gzopen). (David Carlier)
25 Sep 2025, PHP 8.3.26
- Core:

12
ext/zlib/tests/gh19922.phpt Normal file
View File

@@ -0,0 +1,12 @@
--TEST--
GH-19922 (gzopen double free on debug build and unseekable stream)
--EXTENSIONS--
zlib
--FILE--
<?php
var_dump(gzopen("php://output", 14));
?>
--EXPECTF--
Warning: gzopen(php://output): could not make seekable - php://output in %s on line %d
bool(false)

9
main/streams/streams.c
View File

@@ -2219,7 +2219,6 @@ PHPAPI php_stream *_php_stream_open_wrapper_ex(const char *path, const char *mod
int persistent = options & STREAM_OPEN_PERSISTENT;
zend_string *path_str = NULL;
zend_string *resolved_path = NULL;
char *copy_of_path = NULL;
if (opened_path) {
if (options & STREAM_OPEN_FOR_ZEND_STREAM) {
@@ -2296,8 +2295,7 @@ PHPAPI php_stream *_php_stream_open_wrapper_ex(const char *path, const char *mod
if (stream->orig_path) {
pefree(stream->orig_path, persistent);
}
copy_of_path = pestrdup(path, persistent);
stream->orig_path = copy_of_path;
stream->orig_path = pestrdup(path, persistent);
#if ZEND_DEBUG
stream->open_filename = __zend_orig_filename ? __zend_orig_filename : __zend_filename;
stream->open_lineno = __zend_orig_lineno ? __zend_orig_lineno : __zend_lineno;
@@ -2356,11 +2354,6 @@ PHPAPI php_stream *_php_stream_open_wrapper_ex(const char *path, const char *mod
}
}
php_stream_tidy_wrapper_error_log(wrapper);
#if ZEND_DEBUG
if (stream == NULL && copy_of_path != NULL) {
pefree(copy_of_path, persistent);
}
#endif
if (resolved_path) {
zend_string_release_ex(resolved_path, 0);
}