Skip to content

Commit df579ad

Browse files
nielsdosdevnexen
authored andcommitted
Fix GH-10692: PHP crashes on Windows when an inexistent filename is executed
Fixes GH-10692 php_fopen_primary_script() does not initialize all fields of zend_file_handle. So when it fails and when fastcgi is true, the zend_destroy_file_handle() function will try to free uninitialized pointers, causing a segmentation fault. Fix it by zero-initializing file handles just like the zend_stream_init_fp() counterpart does. Closes GH-10697.
1 parent 7d2b01e commit df579ad

File tree

2 files changed

+4
-0
lines changed

2 files changed

+4
-0
lines changed

NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ PHP NEWS
1616
misleadingly with the wrong return type. (nielsdos)
1717
. Fix bug GH-10570 (Fixed unknown string hash on property fetch with integer
1818
constant name). (nielsdos)
19+
. Fixed php_fopen_primary_script() call resulted on zend_destroy_file_handle()
20+
freeing dangling pointers on the handle as it was uninitialized. (nielsdos)
1921

2022
- Curl:
2123
. Fixed deprecation warning at compile time. (Max Kellermann)

main/fopen_wrappers.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -353,6 +353,8 @@ PHPAPI int php_fopen_primary_script(zend_file_handle *file_handle)
353353
size_t length;
354354
bool orig_display_errors;
355355

356+
memset(file_handle, 0, sizeof(zend_file_handle));
357+
356358
path_info = SG(request_info).request_uri;
357359
#if HAVE_PWD_H
358360
if (PG(user_dir) && *PG(user_dir) && path_info && '/' == path_info[0] && '~' == path_info[1]) {

0 commit comments

Comments
 (0)