Skip to content

Commit b983580

Browse files
alexdowadnikic
authored andcommitted
Don't leak memory if wrong resource type is passed to proc_open
proc_open can accept stream resources in the descriptorspec, like this: proc_open("command", array(0 => $resource), $pipes); Previously, if a resource which was *not* of type "stream" was passed, proc_open would return without freeing dynamically allocated memory. It's fixed now.
1 parent a84cd96 commit b983580

File tree

2 files changed

+19
-3
lines changed

2 files changed

+19
-3
lines changed

ext/standard/proc_open.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -933,12 +933,14 @@ PHP_FUNCTION(proc_open)
933933

934934
if (Z_TYPE_P(descitem) == IS_RESOURCE) {
935935
/* should be a stream - try and dup the descriptor */
936-
php_stream *stream;
936+
php_stream *stream = (php_stream*)zend_fetch_resource(Z_RES_P(descitem), "stream", php_file_le_stream());
937+
if (stream == NULL) {
938+
goto exit_fail;
939+
}
940+
937941
php_socket_t fd;
938942
php_file_descriptor_t desc;
939943

940-
php_stream_from_zval(stream, descitem);
941-
942944
if (FAILURE == php_stream_cast(stream, PHP_STREAM_AS_FD, (void **)&fd, REPORT_ERRORS)) {
943945
goto exit_fail;
944946
}
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
--TEST--
2+
proc_open does not leak memory when called with wrong resource type in descriptorspec
3+
--FILE--
4+
<?php
5+
$context = stream_context_create();
6+
try {
7+
proc_open('not_a_real_command_but_I_dont_care', array(0 => $context), $pipes);
8+
echo "Not reached";
9+
} catch (TypeError $e) {
10+
echo $e->getMessage(), "\n";
11+
}
12+
?>
13+
--EXPECT--
14+
proc_open(): supplied resource is not a valid stream resource

0 commit comments

Comments
 (0)