Bug #68986 [NEW]: pointer returned by php_stream_fopen_temporary_file not validated in memory.c

From: nayana at ddproperty dot com Operating system: Linux PHP version: master-Git-2015-02-05 (Git) Package: Streams related Bug Type: Bug Bug description:pointer returned by php_stream_fopen_temporary_file not validated in memory.c Description: ------------ it seems that the pointer returned by php_stream_fopen_temporary_file / php_stream_fopen_tmpfile is not validated prior to use in memory.c in the case where a script is executed in an environment where the TMPDIR is not writable to the user, it will cause a SIGSEGV. from the script side any code that utilize php://temp with 2MB+ buffer with the above condition will encounter this issue. i have fixed the problem on all the calling code in memory.c using php_error_docref, i see that in phar they have handled the condition with zend_throw_exception_ex. i am not in a position to decide which one is best at this time. i think a friendly warning is better than a SIGSEGV at this point :) i have validated this problem exists on github-master and releases 5.4.37, 5.4.17 i will post my pull-request in a comment Test script: --------------- #mkdir /tmp/x #chmod 444 /tmp/x #export TMPDIR=/tmp/x $fp = fopen('php://temp', 'r+'); $data = implode('', array_fill(0, (1024 * 1024 * 2), 'A')); fwrite($fp, $data); -- Edit bug report at https://bugs.php.net/bug.php?id=68986&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68986&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68986&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68986&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68986&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68986&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68986&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68986&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68986&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68986&r=support Expected behavior: https://bugs.php.net/fix.php?id=68986&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68986&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68986&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68986&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68986&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68986&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68986&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68986&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68986&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68986&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68986&r=mysqlcfg