Skip to content

Commit d3b0efe

Browse files
committed
Fix phpGH-16390: dba_open() can segfault for "pathless" streams
`dba_open()` accepts arbitrary stream wrapper paths, but unless no locking (`-`) is specified, we try to determine the underlying file path. If that fails, we need to error out. Closes phpGH-16498.
1 parent 9ca68e0 commit d3b0efe

File tree

3 files changed

+26
-5
lines changed

3 files changed

+26
-5
lines changed

NEWS

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ PHP NEWS
2323
(cmb)
2424
. Fixed bug GH-16037 (Assertion failure in ext/date/php_date.c). (Derick)
2525

26+
- DBA:
27+
. Fixed bug GH-16390 (dba_open() can segfault for "pathless" streams). (cmb)
28+
2629
- DOM:
2730
. Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
2831
(nielsdos)

ext/dba/dba.c

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -772,11 +772,18 @@ static void php_dba_open(INTERNAL_FUNCTION_PARAMETERS, bool persistent)
772772
info->lock.fp = php_stream_open_wrapper(lock_name, lock_file_mode, STREAM_MUST_SEEK|REPORT_ERRORS|IGNORE_PATH|persistent_flag, &opened_path);
773773
if (info->lock.fp) {
774774
if (is_db_lock) {
775-
/* replace the path info with the real path of the opened file */
776-
pefree(info->path, persistent);
777-
info->path = pestrndup(ZSTR_VAL(opened_path), ZSTR_LEN(opened_path), persistent);
775+
if (opened_path) {
776+
/* replace the path info with the real path of the opened file */
777+
pefree(info->path, persistent);
778+
info->path = pestrndup(ZSTR_VAL(opened_path), ZSTR_LEN(opened_path), persistent);
779+
} else {
780+
error = "Unable to determine path for locking";
781+
}
778782
}
783+
}
784+
if (opened_path) {
779785
zend_string_release_ex(opened_path, 0);
786+
opened_path = NULL;
780787
}
781788
}
782789
if (!is_db_lock) {
@@ -788,10 +795,10 @@ static void php_dba_open(INTERNAL_FUNCTION_PARAMETERS, bool persistent)
788795
FREE_PERSISTENT_RESOURCE_KEY();
789796
RETURN_FALSE;
790797
}
791-
if (!php_stream_supports_lock(info->lock.fp)) {
798+
if (!error && !php_stream_supports_lock(info->lock.fp)) {
792799
error = "Stream does not support locking";
793800
}
794-
if (php_stream_lock(info->lock.fp, lock_mode)) {
801+
if (!error && php_stream_lock(info->lock.fp, lock_mode)) {
795802
error = "Unable to establish lock"; /* force failure exit */
796803
}
797804
}

ext/dba/tests/gh16390.phpt

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
--TEST--
2+
GH-16390 (dba_open() can segfault for "pathless" streams)
3+
--EXTENSIONS--
4+
dba
5+
--FILE--
6+
<?php
7+
$file = 'data:text/plain;z=y;uri=eviluri;mediatype=wut?;mediatype2=hello,somedata';
8+
$db = dba_open($file, 'c', 'inifile');
9+
?>
10+
--EXPECTF--
11+
Warning: dba_open(): Driver initialization failed for handler: inifile: Unable to determine path for locking in %s on line %d

0 commit comments

Comments
 (0)