diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2020-01-08 11:52:24 +0100 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-01-08 18:29:10 +0100 |
| commit | 0dda4a844e63ccbcff1053fff65649dab0fd348f (patch) | |
| tree | 083f3e8916d38ebeca80429ebc0416345365e1fa | |
| parent | 38c0a53b60059e06128f61a28573d6c10b60d1d2 (diff) | |
| download | php-git-0dda4a844e63ccbcff1053fff65649dab0fd348f.tar.gz | |
Fix #79078: Hypothetical use-after-free in curl_multi_add_handle()
To avoid this, we have to verify the handlers already in
`curl_multi_add_handle()`, not only in `curl_multi_exec()`.
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | ext/curl/multi.c | 2 | ||||
| -rw-r--r-- | ext/curl/tests/bug48203_multi.phpt | 18 |
3 files changed, 15 insertions, 9 deletions
@@ -2,6 +2,10 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? ????, PHP 7.3.15 +- CURL: + . Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()). + (cmb) + 23 Jan 2020, PHP 7.3.14 - Core diff --git a/ext/curl/multi.c b/ext/curl/multi.c index d10a03f741..af31e28adf 100644 --- a/ext/curl/multi.c +++ b/ext/curl/multi.c @@ -92,6 +92,8 @@ PHP_FUNCTION(curl_multi_add_handle) RETURN_FALSE; } + _php_curl_verify_handlers(ch, 1); + _php_curl_cleanup_handle(ch); GC_ADDREF(Z_RES_P(z_ch)); diff --git a/ext/curl/tests/bug48203_multi.phpt b/ext/curl/tests/bug48203_multi.phpt index 5f9e2ba6b2..3834b5bcd5 100644 --- a/ext/curl/tests/bug48203_multi.phpt +++ b/ext/curl/tests/bug48203_multi.phpt @@ -67,25 +67,25 @@ foreach($options_to_check as $option) { --CLEAN-- <?php @unlink(dirname(__FILE__) . '/bug48203.tmp'); ?> --EXPECTF-- -Warning: curl_multi_exec(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d - -Warning: curl_multi_exec(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d +Warning: curl_multi_add_handle(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d +%A +Warning: curl_multi_add_handle(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d %A Ok for CURLOPT_STDERR -Warning: curl_multi_exec(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d +Warning: curl_multi_add_handle(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d -Warning: curl_multi_exec(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d +Warning: curl_multi_add_handle(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d Ok for CURLOPT_WRITEHEADER -Warning: curl_multi_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d +Warning: curl_multi_add_handle(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d -Warning: curl_multi_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d +Warning: curl_multi_add_handle(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d Hello World! Hello World!Hello World! Hello World!Ok for CURLOPT_FILE -Warning: curl_multi_exec(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d +Warning: curl_multi_add_handle(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d -Warning: curl_multi_exec(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d +Warning: curl_multi_add_handle(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d Ok for CURLOPT_INFILE |