Skip to content

Commit 6a5b7b8

Browse files
committed
Don't leak memory if wrong resource type is passed to proc_open
proc_open can accept stream resources in the descriptorspec, like this: proc_open("command", array(0 => $resource), $pipes); Previously, if a resource which was *not* of type "stream" was passed, proc_open would return without freeing dynamically allocated memory. It's fixed now.
1 parent 0433d3c commit 6a5b7b8

File tree

2 files changed

+18
-3
lines changed

2 files changed

+18
-3
lines changed

ext/standard/proc_open.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -933,12 +933,14 @@ PHP_FUNCTION(proc_open)
933933

934934
if (Z_TYPE_P(descitem) == IS_RESOURCE) {
935935
/* should be a stream - try and dup the descriptor */
936-
php_stream *stream;
936+
php_stream *stream = (php_stream*)zend_fetch_resource(Z_RES_P(descitem), "stream", php_file_le_stream());
937+
if (stream == NULL) {
938+
goto exit_fail;
939+
}
940+
937941
php_socket_t fd;
938942
php_file_descriptor_t desc;
939943

940-
php_stream_from_zval(stream, descitem);
941-
942944
if (FAILURE == php_stream_cast(stream, PHP_STREAM_AS_FD, (void **)&fd, REPORT_ERRORS)) {
943945
goto exit_fail;
944946
}
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
--TEST--
2+
proc_open does not leak memory when called with wrong resource type in descriptorspec
3+
--FILE--
4+
<?php
5+
$context = stream_context_create();
6+
$child = proc_open('not_a_real_command_but_I_dont_care', array(0 => $context), $pipes);
7+
echo "Not reached\n";
8+
--EXPECTF--
9+
Fatal error: Uncaught TypeError: proc_open(): supplied resource is not a valid stream resource in %s:3
10+
Stack trace:
11+
#0 %s(3): proc_open('not_a_real_comm...', Array, NULL)
12+
#1 {main}
13+
thrown in %s on line 3

0 commit comments

Comments
 (0)