Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Fix GH-20286: use-after-destroy during userland stream_close(). #20348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
devnexen wants to merge 4 commits into php:PHP-8.3
base: PHP-8.3
Choose a base branch
Loading
from devnexen:gh20286-2

Conversation

@devnexen
Copy link
Member

@devnexen devnexen commented Oct 31, 2025

No description provided.

fci.param_count = param_count;
fci.params = params;
fci.named_params = NULL;
if (EG(active)) {
Copy link
Member

@iluuu1994 iluuu1994 Oct 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use an early return.

uint32_t param_count, zval *params)
{
if (UNEXPECTED(!EG(active))) {
#ifdef ZEND_DEBUG
Copy link
Member

@iluuu1994 iluuu1994 Oct 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should be #if rather than #ifdef, ZEND_DEBUG always declared in main/php_config.h but may be 0.

#ifdef ZEND_DEBUG
ZEND_UNREACHABLE();
#endif
return FAILURE;
Copy link
Member

@iluuu1994 iluuu1994 Oct 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There should probably be a ZVAL_UNDEF(retval); as below.


if (UNEXPECTED(stream->wrapper->wops != &user_stream_wops)) {
stream->wrapper->wops = &user_stream_wops;
}
Copy link
Member

@iluuu1994 iluuu1994 Nov 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks a bit odd, why is this necessary?

Copy link
Member Author

@devnexen devnexen Nov 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Program received signal SIGSEGV, Segmentation fault.
0x0000555555aa0f35 in _php_stream_free (stream=<optimized out>, close_options=close_options@entry=11) at /home/dcarlier/Contribs/php-src/main/streams/streams.c:505
505				stream->wrapper->wops->stream_closer(stream->wrapper, stream);
(gdb) p *stream->wrapper->wops
2ドル = {stream_opener = 0x7ffff767be60, stream_closer = 0xc0d29af9ee47b9cc, stream_stat = 0xb, url_stat = 0x735f6d6165727473, dir_opener = 0x6f69747000746174, 
 label = 0x6e <error: Cannot access memory at address 0x6e>, unlink = 0x0, rename = 0x5555568bc500, stream_mkdir = 0x0, stream_rmdir = 0x5a0, stream_metadata = 0x7ffff767beb0}
(gdb) p *stream->wrapper->wops->stream_closer
Cannot access memory at address 0xc0d29af9ee47b9cc
(gdb)

--FILE--
<?php
class lib {
function stream_open() {
Copy link
Member

@iluuu1994 iluuu1994 Nov 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you indent by 4 spaces?

?>
--EXPECTF--

Deprecated: Creation of dynamic property lib::$context is deprecated in %s on line %d
Copy link
Member

@iluuu1994 iluuu1994 Nov 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe create the $context prop and create empty stubs for these functions to make the warnings go away.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@iluuu1994 iluuu1994 iluuu1994 left review comments

@dstogov dstogov Awaiting requested review from dstogov dstogov will be requested when the pull request is marked ready for review dstogov is a code owner

@bukka bukka Awaiting requested review from bukka bukka will be requested when the pull request is marked ready for review bukka is a code owner

Assignees

No one assigned

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

AltStyle によって変換されたページ (->オリジナル) /