diff options
| author | dinosaur <thedinosaurmail@gmail.com> | 2020-04-14 07:46:34 +0800 |
|---|---|---|
| committer | Sara Golemon <pollita@php.net> | 2020-04-14 10:27:28 -0400 |
| commit | 13842eda375a87543650fbf95ffc64f00f3586fc (patch) | |
| tree | 72eb4d6163a4b9f6a442e155786f33d268a71e01 | |
| parent | 6df761b7ffc0f54d9d282c394a2a5e53c3d036ef (diff) | |
| download | php-git-13842eda375a87543650fbf95ffc64f00f3586fc.tar.gz | |
Fixed bug #79468
Close the stream filter resources when removing them from the stream.
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/standard/tests/filters/bug79468.phpt | 21 | ||||
| -rw-r--r-- | main/streams/streams.c | 6 |
3 files changed, 29 insertions, 0 deletions
@@ -3,6 +3,8 @@ PHP NEWS ?? ??? 2020, PHP 7.2.30 - Standard: + . Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter + appended). (dinosaur) . Fixed bug #79330 (shell_exec() silently truncates after a null byte). (stas) . Fixed bug #79465 (OOB Read in urldecode()). (stas) diff --git a/ext/standard/tests/filters/bug79468.phpt b/ext/standard/tests/filters/bug79468.phpt new file mode 100644 index 0000000000..60a848ec01 --- /dev/null +++ b/ext/standard/tests/filters/bug79468.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #79468 SIGSEGV when closing stream handle with a stream filter appended +--SKIPIF-- +<?php +$filters = stream_get_filters(); +if(! in_array( "string.rot13", $filters )) die( "skip rot13 filter not available." ); +?> +--FILE-- +<?php +$fp = fopen('php://temp', 'rb'); +$rot13_filter = stream_filter_append($fp, "string.rot13", STREAM_FILTER_WRITE); +fwrite($fp, "This is "); +fclose($fp); +try { + stream_filter_remove($rot13_filter); +} catch (\Throwable $e) { + var_dump($e->getMessage()); +} +?> +--EXPECTF-- +Warning: stream_filter_remove(): Invalid resource given, not a stream filter in %s on line %d diff --git a/main/streams/streams.c b/main/streams/streams.c index b504711db3..bf9537d33c 100644 --- a/main/streams/streams.c +++ b/main/streams/streams.c @@ -477,9 +477,15 @@ fprintf(stderr, "stream_free: %s:%p[%s] preserve_handle=%d release_cast=%d remov if (close_options & PHP_STREAM_FREE_RELEASE_STREAM) { while (stream->readfilters.head) { + if (stream->readfilters.head->res != NULL) { + zend_list_close(stream->readfilters.head->res); + } php_stream_filter_remove(stream->readfilters.head, 1); } while (stream->writefilters.head) { + if (stream->writefilters.head->res != NULL) { + zend_list_close(stream->writefilters.head->res); + } php_stream_filter_remove(stream->writefilters.head, 1); } |