Skip to content

Fix for imap_send - #10

Closed
Keloran wants to merge 2 commits into
php:masterfrom
Keloran:master
Closed

Fix for imap_send#10
Keloran wants to merge 2 commits into
php:masterfrom
Keloran:master

Conversation

@Keloran

Copy link
Copy Markdown

This actually makes the rpath option in imap_send actually do something, instead of just being ignored

@KeloranKeloran closed this Mar 20, 2012
php-pulls pushed a commit that referenced this pull request Dec 20, 2013
shqking added a commit that referenced this pull request Apr 20, 2021
The following opcodes would be generated:
...
BB1:
0003 JMP BB3
BB2:
0004 INIT_FCALL 1 96 string("chr")
0005 #10.T3 [long] = SR #3.CV0($int) [long] #7.CV2($i) ...
0006 #11.T4 [long] RANGE[0..127] = BW_AND #10.T3 [long] ...
0007 #12.T3 [long] RANGE[128..255] = BW_OR #11.T4 [long] ...
0008 SEND_VAL #12.T3 [long] RANGE[128..255] 1
0009 #13.V3 [ref, rc1, rcn, any] = DO_ICALL
0010 ASSIGN_OP (CONCAT) #6.CV1($out) [rc1, rcn, string]
0011 ADD #7.CV2($i)... int(7) #7.CV2($i) ... -> #15.CV2($i) ...
BB3:
0012 #8.T4 [long] = SR #3.CV0($int) #7.CV2($i) [long, double]
0013 #9.T3 [bool] RANGE[0..1] = IS_SMALLER int(128) #8.T4
0014 JMPNZ #9.T3 [bool] RANGE[0..1] BB2
...
Main changes are:
1. SR opcode covers new path in function zend_jit_long_math_helper().
2. BW_AND and BW_OR opcodes are supported. See macro LONG_OP.
3. Function zend_jit_concat_helper() is added to support ASSIGN_OP
opcode. Speficically, CONCAT and FAST_CONCAT is supported for statements
"$out .= ...".
4. New path is covered in function zend_jit_cmp_long_long() by
IS_SMALLER opcode.
5. New path is covered in macros ZVAL_PTR_DTOR and ZVAL_DTOR_FUNC when
leaving.
dstogov pushed a commit that referenced this pull request Apr 29, 2021
The following opcodes would be generated:
...
BB1:
0003 JMP BB3
BB2:
0004 INIT_FCALL 1 96 string("chr")
0005 #10.T3 [long] = SR #3.CV0($int) [long] #7.CV2($i) ...
0006 #11.T4 [long] RANGE[0..127] = BW_AND #10.T3 [long] ...
0007 #12.T3 [long] RANGE[128..255] = BW_OR #11.T4 [long] ...
0008 SEND_VAL #12.T3 [long] RANGE[128..255] 1
0009 #13.V3 [ref, rc1, rcn, any] = DO_ICALL
0010 ASSIGN_OP (CONCAT) #6.CV1($out) [rc1, rcn, string]
0011 ADD #7.CV2($i)... int(7) #7.CV2($i) ... -> #15.CV2($i) ...
BB3:
0012 #8.T4 [long] = SR #3.CV0($int) #7.CV2($i) [long, double]
0013 #9.T3 [bool] RANGE[0..1] = IS_SMALLER int(128) #8.T4
0014 JMPNZ #9.T3 [bool] RANGE[0..1] BB2
...
Main changes are:
1. SR opcode covers new path in function zend_jit_long_math_helper().
2. BW_AND and BW_OR opcodes are supported. See macro LONG_OP.
3. Function zend_jit_concat_helper() is added to support ASSIGN_OP
opcode. Speficically, CONCAT and FAST_CONCAT is supported for statements
"$out .= ...".
4. New path is covered in function zend_jit_cmp_long_long() by
IS_SMALLER opcode.
5. New path is covered in macros ZVAL_PTR_DTOR and ZVAL_DTOR_FUNC when
leaving.
dstogov pushed a commit that referenced this pull request May 12, 2021
The following opcodes would be generated:
...
BB1:
0003 JMP BB3
BB2:
0004 INIT_FCALL 1 96 string("chr")
0005 #10.T3 [long] = SR #3.CV0($int) [long] #7.CV2($i) ...
0006 #11.T4 [long] RANGE[0..127] = BW_AND #10.T3 [long] ...
0007 #12.T3 [long] RANGE[128..255] = BW_OR #11.T4 [long] ...
0008 SEND_VAL #12.T3 [long] RANGE[128..255] 1
0009 #13.V3 [ref, rc1, rcn, any] = DO_ICALL
0010 ASSIGN_OP (CONCAT) #6.CV1($out) [rc1, rcn, string]
0011 ADD #7.CV2($i)... int(7) #7.CV2($i) ... -> #15.CV2($i) ...
BB3:
0012 #8.T4 [long] = SR #3.CV0($int) #7.CV2($i) [long, double]
0013 #9.T3 [bool] RANGE[0..1] = IS_SMALLER int(128) #8.T4
0014 JMPNZ #9.T3 [bool] RANGE[0..1] BB2
...
Main changes are:
1. SR opcode covers new path in function zend_jit_long_math_helper().
2. BW_AND and BW_OR opcodes are supported. See macro LONG_OP.
3. Function zend_jit_concat_helper() is added to support ASSIGN_OP
opcode. Speficically, CONCAT and FAST_CONCAT is supported for statements
"$out .= ...".
4. New path is covered in function zend_jit_cmp_long_long() by
IS_SMALLER opcode.
5. New path is covered in macros ZVAL_PTR_DTOR and ZVAL_DTOR_FUNC when
leaving.
dstogov pushed a commit that referenced this pull request May 14, 2021
The following opcodes would be generated:
...
BB1:
0003 JMP BB3
BB2:
0004 INIT_FCALL 1 96 string("chr")
0005 #10.T3 [long] = SR #3.CV0($int) [long] #7.CV2($i) ...
0006 #11.T4 [long] RANGE[0..127] = BW_AND #10.T3 [long] ...
0007 #12.T3 [long] RANGE[128..255] = BW_OR #11.T4 [long] ...
0008 SEND_VAL #12.T3 [long] RANGE[128..255] 1
0009 #13.V3 [ref, rc1, rcn, any] = DO_ICALL
0010 ASSIGN_OP (CONCAT) #6.CV1($out) [rc1, rcn, string]
0011 ADD #7.CV2($i)... int(7) #7.CV2($i) ... -> #15.CV2($i) ...
BB3:
0012 #8.T4 [long] = SR #3.CV0($int) #7.CV2($i) [long, double]
0013 #9.T3 [bool] RANGE[0..1] = IS_SMALLER int(128) #8.T4
0014 JMPNZ #9.T3 [bool] RANGE[0..1] BB2
...
Main changes are:
1. SR opcode covers new path in function zend_jit_long_math_helper().
2. BW_AND and BW_OR opcodes are supported. See macro LONG_OP.
3. Function zend_jit_concat_helper() is added to support ASSIGN_OP
opcode. Speficically, CONCAT and FAST_CONCAT is supported for statements
"$out .= ...".
4. New path is covered in function zend_jit_cmp_long_long() by
IS_SMALLER opcode.
5. New path is covered in macros ZVAL_PTR_DTOR and ZVAL_DTOR_FUNC when
leaving.
dstogov pushed a commit that referenced this pull request May 18, 2021
The following opcodes would be generated:
...
BB1:
0003 JMP BB3
BB2:
0004 INIT_FCALL 1 96 string("chr")
0005 #10.T3 [long] = SR #3.CV0($int) [long] #7.CV2($i) ...
0006 #11.T4 [long] RANGE[0..127] = BW_AND #10.T3 [long] ...
0007 #12.T3 [long] RANGE[128..255] = BW_OR #11.T4 [long] ...
0008 SEND_VAL #12.T3 [long] RANGE[128..255] 1
0009 #13.V3 [ref, rc1, rcn, any] = DO_ICALL
0010 ASSIGN_OP (CONCAT) #6.CV1($out) [rc1, rcn, string]
0011 ADD #7.CV2($i)... int(7) #7.CV2($i) ... -> #15.CV2($i) ...
BB3:
0012 #8.T4 [long] = SR #3.CV0($int) #7.CV2($i) [long, double]
0013 #9.T3 [bool] RANGE[0..1] = IS_SMALLER int(128) #8.T4
0014 JMPNZ #9.T3 [bool] RANGE[0..1] BB2
...
Main changes are:
1. SR opcode covers new path in function zend_jit_long_math_helper().
2. BW_AND and BW_OR opcodes are supported. See macro LONG_OP.
3. Function zend_jit_concat_helper() is added to support ASSIGN_OP
opcode. Speficically, CONCAT and FAST_CONCAT is supported for statements
"$out .= ...".
4. New path is covered in function zend_jit_cmp_long_long() by
IS_SMALLER opcode.
5. New path is covered in macros ZVAL_PTR_DTOR and ZVAL_DTOR_FUNC when
leaving.
@AlexeyZamorovAlexeyZamorov mentioned this pull request Aug 26, 2021
devnexen added a commit that referenced this pull request Oct 13, 2024
even without sanitizers, it is reproducible but with the following
```
<?php
$g = gmp_init(256);
var_dump(gmp_pow($g, PHP_INT_MAX));
```
we get this
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==286922==ERROR: AddressSanitizer: FPE on unknown address 0x03e8000460ca (pc 0x7faf6c69de5c bp 0x400000000000004 sp 0x7ffe9843c740 T0)
#0 0x7faf6c69de5c in __pthread_kill_implementation nptl/pthread_kill.c:44
#1 0x7faf6c649c81 in __GI_raise ../sysdeps/posix/raise.c:26
#2 0x7faf6db9386c in __gmp_exception (/lib/x86_64-linux-gnu/libgmp.so.10+0xd86c) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
#3 0x7faf6db938d3 in __gmp_overflow_in_mpz (/lib/x86_64-linux-gnu/libgmp.so.10+0xd8d3) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
#4 0x7faf6dbac95c in __gmpz_realloc (/lib/x86_64-linux-gnu/libgmp.so.10+0x2695c) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
#5 0x7faf6dba9038 in __gmpz_n_pow_ui (/lib/x86_64-linux-gnu/libgmp.so.10+0x23038) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
#6 0x5565ae1ccd9f in zif_gmp_pow /home/dcarlier/Contribs/php-src/ext/gmp/gmp.c:1286
#7 0x5565aee96ea9 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:1312
#8 0x5565af144320 in execute_ex /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:56075
#9 0x5565af160f07 in zend_execute /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:60439
#10 0x5565aed6fafe in zend_execute_scripts /home/dcarlier/Contribs/php-src/Zend/zend.c:1842
#11 0x5565aeae70a8 in php_execute_script /home/dcarlier/Contribs/php-src/main/main.c:2578
#12 0x5565af532f4e in do_cli /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:964
#13 0x5565af535877 in main /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:1334
#14 0x7faf6c633d67 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#15 0x7faf6c633e24 in __libc_start_main_impl ../csu/libc-start.c:360
#16 0x5565adc04040 in _start (/home/dcarlier/Contribs/php-src/sapi/cli/php+0x2604040) (BuildId: 949049955bdf8b7197390b1978a1dfc3ef6fdf38)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE nptl/pthread_kill.c:44 in __pthread_kill_implementation
==286922==ABORTING
```
devnexen added a commit to devnexen/php-src that referenced this pull request Oct 24, 2024
even without sanitizers, it is reproducible but with the following
```
<?php
$g = gmp_init(256);
var_dump(gmp_pow($g, PHP_INT_MAX));
```
we get this
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==286922==ERROR: AddressSanitizer: FPE on unknown address 0x03e8000460ca (pc 0x7faf6c69de5c bp 0x400000000000004 sp 0x7ffe9843c740 T0)
#0 0x7faf6c69de5c in __pthread_kill_implementation nptl/pthread_kill.c:44
#1 0x7faf6c649c81 in __GI_raise ../sysdeps/posix/raise.c:26
php#2 0x7faf6db9386c in __gmp_exception (/lib/x86_64-linux-gnu/libgmp.so.10+0xd86c) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
php#3 0x7faf6db938d3 in __gmp_overflow_in_mpz (/lib/x86_64-linux-gnu/libgmp.so.10+0xd8d3) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
php#4 0x7faf6dbac95c in __gmpz_realloc (/lib/x86_64-linux-gnu/libgmp.so.10+0x2695c) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
php#5 0x7faf6dba9038 in __gmpz_n_pow_ui (/lib/x86_64-linux-gnu/libgmp.so.10+0x23038) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
php#6 0x5565ae1ccd9f in zif_gmp_pow /home/dcarlier/Contribs/php-src/ext/gmp/gmp.c:1286
php#7 0x5565aee96ea9 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:1312
php#8 0x5565af144320 in execute_ex /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:56075
php#9 0x5565af160f07 in zend_execute /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:60439
php#10 0x5565aed6fafe in zend_execute_scripts /home/dcarlier/Contribs/php-src/Zend/zend.c:1842
php#11 0x5565aeae70a8 in php_execute_script /home/dcarlier/Contribs/php-src/main/main.c:2578
php#12 0x5565af532f4e in do_cli /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:964
php#13 0x5565af535877 in main /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:1334
php#14 0x7faf6c633d67 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
php#15 0x7faf6c633e24 in __libc_start_main_impl ../csu/libc-start.c:360
php#16 0x5565adc04040 in _start (/home/dcarlier/Contribs/php-src/sapi/cli/php+0x2604040) (BuildId: 949049955bdf8b7197390b1978a1dfc3ef6fdf38)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE nptl/pthread_kill.c:44 in __pthread_kill_implementation
==286922==ABORTING
```
ndossche added a commit that referenced this pull request Apr 4, 2026
This causes UB later on when the certificate is passed to another
function:
```
/work/php-src/Zend/zend_string.h:191:2: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x55cfb9407d94 in zend_string_init /work/php-src/Zend/zend_string.h:191
#1 0x55cfb941ceb6 in add_assoc_stringl_ex /work/php-src/Zend/zend_API.c:1986
#2 0x55cfb7f4c16d in add_assoc_stringl /work/php-src/Zend/zend_API.h:579
#3 0x55cfb7f4cccd in php_openssl_add_assoc_asn1_string /work/php-src/ext/openssl/openssl_backend_common.c:113
#4 0x55cfb7f2eb98 in zif_openssl_x509_parse /work/php-src/ext/openssl/openssl.c:1074
#5 0x55cfb9160993 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
#6 0x55cfb958ee2d in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154
#7 0x55cfb97854bd in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519
#8 0x55cfb9795c96 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#9 0x55cfb99666c6 in zend_execute_script /work/php-src/Zend/zend.c:1980
#10 0x55cfb919583e in php_execute_script_ex /work/php-src/main/main.c:2645
#11 0x55cfb9195b48 in php_execute_script /work/php-src/main/main.c:2685
#12 0x55cfb996bf48 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#13 0x55cfb996e6a1 in main /work/php-src/sapi/cli/php_cli.c:1362
#14 0x7fb0b68301c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#15 0x7fb0b683028a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#16 0x55cfb7e097d4 in _start (/work/php-src/build-dbg-ubsan/sapi/cli/php+0x14097d4) (BuildId: b2b405964cc047ab6da19abaf92a8899a99e4a47)
```
Furthermore, it also simply does not propagate the error to userland.
ClosesGH-21046.
ndossche added a commit that referenced this pull request Apr 4, 2026
This can actually fail because internally this function does stack
management in internal data structures.
Can cause a crash later, e.g.:
```
==239255==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x5652d8f2fe68 bp 0x7ffc99ee8fc0 sp 0x7ffc99ee8ec0 T0)
==239255==The signal is caused by a READ memory access.
==239255==Hint: address points to the zero page.
#0 0x5652d8f2fe68 in php_openssl_limit_handshake_reneg /work/php-src/ext/openssl/xp_ssl.c:1080
#1 0x5652d8f306e2 in php_openssl_info_callback /work/php-src/ext/openssl/xp_ssl.c:1137
#2 0x7f45057b84e5 (/lib/x86_64-linux-gnu/libssl.so.3+0x694e5) (BuildId: 5f3b12d47114f9fbdc7765266cd0bb8f1b5ee8fc)
#3 0x5652d8f351d9 in php_openssl_enable_crypto /work/php-src/ext/openssl/xp_ssl.c:1850
#4 0x5652d8f39c86 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2516
#5 0x5652d9d4c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466
#6 0x5652d9d557c1 in php_stream_xport_crypto_enable /work/php-src/main/streams/transports.c:387
#7 0x5652d8f387be in php_openssl_tcp_sockop_accept /work/php-src/ext/openssl/xp_ssl.c:2279
#8 0x5652d8f39fcd in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2551
#9 0x5652d9d4c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466
#10 0x5652d9d54d3a in php_stream_xport_accept /work/php-src/main/streams/transports.c:307
#11 0x5652d9b50161 in zif_stream_socket_accept /work/php-src/ext/standard/streamsfuncs.c:298
#12 0x5652d9fdacfb in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /work/php-src/Zend/zend_vm_execute.h:1355
#13 0x5652da140689 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116469
#14 0x5652da1558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#15 0x5652da2ba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980
#16 0x5652d9cec8bb in php_execute_script_ex /work/php-src/main/main.c:2645
#17 0x5652d9cecccb in php_execute_script /work/php-src/main/main.c:2685
#18 0x5652da2bfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#19 0x5652da2c21e3 in main /work/php-src/sapi/cli/php_cli.c:1362
#20 0x7f4504ebc1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#21 0x7f4504ebc28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#22 0x5652d8e09b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c)
```
ClosesGH-21049.
wheakerd pushed a commit to wheakerd/php-src that referenced this pull request May 22, 2026
…dict
```
Direct leak of 52 byte(s) in 1 object(s) allocated from:
#0 0x7ff90cd2c161 in malloc (/usr/lib/libasan.so.8+0x12c161) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e)
php#1 0x55de10c9a468 in tracked_malloc /work/php-8.4/Zend/zend_alloc.c:2973
php#2 0x55de10c99443 in _emalloc /work/php-8.4/Zend/zend_alloc.c:2740
php#3 0x55de102deb86 in zlib_create_dictionary_string /work/php-8.4/ext/zlib/zlib.c:836
php#4 0x55de102e145a in zif_deflate_init /work/php-8.4/ext/zlib/zlib.c:1144
php#5 0x55de10dcac6c in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /work/php-8.4/Zend/zend_vm_execute.h:1351
php#6 0x55de10f2d69d in execute_ex /work/php-8.4/Zend/zend_vm_execute.h:58907
php#7 0x55de10f41666 in zend_execute /work/php-8.4/Zend/zend_vm_execute.h:64334
php#8 0x55de110a6cf8 in zend_execute_script /work/php-8.4/Zend/zend.c:1934
php#9 0x55de10af0ddb in php_execute_script_ex /work/php-8.4/main/main.c:2577
php#10 0x55de10af128f in php_execute_script /work/php-8.4/main/main.c:2617
php#11 0x55de110ac5e1 in do_cli /work/php-8.4/sapi/cli/php_cli.c:935
php#12 0x55de110ae592 in main /work/php-8.4/sapi/cli/php_cli.c:1322
php#13 0x7ff90c027740 (/usr/lib/libc.so.6+0x27740) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
php#14 0x7ff90c027878 in __libc_start_main (/usr/lib/libc.so.6+0x27878) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
php#15 0x55de10005964 in _start (/work/php-8.4/sapi/cli/php+0x605964) (BuildId: 5f144db4e56ea623e070c56445fb1dfa3f8d085d)
SUMMARY: AddressSanitizer: 52 byte(s) leaked in 1 allocation(s).
```
ClosesphpGH-22101.
bukka pushed a commit that referenced this pull request Jul 1, 2026
…reset
The code tries to read the context on NULL when
`php_stream_xport_crypto_setup` fails because by then `stream` is reset
to NULL.
This is also UB, so can cause miscompiles.
```
==1217==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000090 (pc 0x55d829ed3acf bp 0x7fff045f5770 sp 0x7fff045f4df0 T0)
==1217==The signal is caused by a READ memory access.
==1217==Hint: address points to the zero page.
#0 0x55d829ed3acf in php_stream_url_wrap_http_ex /work/php-src/ext/standard/http_fopen_wrapper.c:580
#1 0x55d829ed857e in php_stream_url_wrap_http /work/php-src/ext/standard/http_fopen_wrapper.c:1204
#2 0x55d82a15073d in _php_stream_open_wrapper_ex /work/php-src/main/streams/streams.c:2270
#3 0x55d829e78fa6 in zif_file_get_contents /work/php-src/ext/standard/file.c:409
#4 0x55d829bbfe39 in zif_phar_file_get_contents /work/php-src/ext/phar/func_interceptors.c:226
#5 0x55d82a0b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
#6 0x55d82a3e024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154
#7 0x55d82a540995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519
#8 0x55d82a5558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#9 0x55d82a6ba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980
#10 0x55d82a0ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645
#11 0x55d82a0ecccb in php_execute_script /work/php-src/main/main.c:2685
#12 0x55d82a6bfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#13 0x55d82a6c21e3 in main /work/php-src/sapi/cli/php_cli.c:1362
#14 0x7f9e770491c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#15 0x7f9e7704928a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#16 0x55d829209b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c)
```
This is a backport of:
* 7782b88
* f9519cc
* afded3d
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
MaxKellermann pushed a commit to CM4all/php-src that referenced this pull request Jul 9, 2026
…reset
The code tries to read the context on NULL when
`php_stream_xport_crypto_setup` fails because by then `stream` is reset
to NULL.
This is also UB, so can cause miscompiles.
```
==1217==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000090 (pc 0x55d829ed3acf bp 0x7fff045f5770 sp 0x7fff045f4df0 T0)
==1217==The signal is caused by a READ memory access.
==1217==Hint: address points to the zero page.
#0 0x55d829ed3acf in php_stream_url_wrap_http_ex /work/php-src/ext/standard/http_fopen_wrapper.c:580
php#1 0x55d829ed857e in php_stream_url_wrap_http /work/php-src/ext/standard/http_fopen_wrapper.c:1204
php#2 0x55d82a15073d in _php_stream_open_wrapper_ex /work/php-src/main/streams/streams.c:2270
php#3 0x55d829e78fa6 in zif_file_get_contents /work/php-src/ext/standard/file.c:409
php#4 0x55d829bbfe39 in zif_phar_file_get_contents /work/php-src/ext/phar/func_interceptors.c:226
php#5 0x55d82a0b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
php#6 0x55d82a3e024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154
php#7 0x55d82a540995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519
php#8 0x55d82a5558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
php#9 0x55d82a6ba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980
php#10 0x55d82a0ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645
php#11 0x55d82a0ecccb in php_execute_script /work/php-src/main/main.c:2685
php#12 0x55d82a6bfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951
php#13 0x55d82a6c21e3 in main /work/php-src/sapi/cli/php_cli.c:1362
php#14 0x7f9e770491c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
php#15 0x7f9e7704928a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
php#16 0x55d829209b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c)
```
This is a backport of:
* 7782b88
* f9519cc
* afded3d
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
This was referenced Jul 21, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@Keloran