[php-src] master: Merge branch 'PHP-8.4' into PHP-8.5

Author: Gina Peter Banyard (Girgias) Date: 2026-10-24T17:42:59+01:00 Commit: https://github.com/php/php-src/commit/92830bd5d32a551b632f58298573d80b1cb9d4ef Raw diff: https://github.com/php/php-src/commit/92830bd5d32a551b632f58298573d80b1cb9d4ef.diff Merge branch 'PHP-8.4' into PHP-8.5 * PHP-8.4: dba: fix GH-24641 (NULL dereferencement with ndbm backend) Changed paths: A ext/dba/tests/gh24641.phpt M NEWS M ext/dba/dba_ndbm.c Diff: diff --git a/NEWS b/NEWS index 0b54af8daefb..2518d1cabee7 100644 --- a/NEWS +++ b/NEWS @@ -32,6 +32,10 @@ PHP NEWS . Fixed bug GH-24350 (MINIT reads a stale external tz database after an in-process module restart). (Lazizbek Ergashev) +- DBA: + . Fixed bug GH-24641 (ndbm backend never checks dbm_open() return value, + NULL deref on first use after a failed open). (Girgias) + - Fileinfo: . Fixed bug GH-24289 (finfo::file() reports the wrong argument number for an invalid $filename). (Lazizbek Ergashev) diff --git a/ext/dba/dba_ndbm.c b/ext/dba/dba_ndbm.c index 40ae304cb7d2..58e4893ec2d2 100644 --- a/ext/dba/dba_ndbm.c +++ b/ext/dba/dba_ndbm.c @@ -53,6 +53,9 @@ DBA_OPEN_FUNC(ndbm) } dbf = dbm_open(ZSTR_VAL(info->path), gmode, filemode); + if (dbf == NULL) { + return FAILURE; + } pinfo->dbf = dbf; return SUCCESS; diff --git a/ext/dba/tests/gh24641.phpt b/ext/dba/tests/gh24641.phpt new file mode 100644 index 000000000000..e7479b64333c --- /dev/null +++ b/ext/dba/tests/gh24641.phpt @@ -0,0 +1,30 @@ +--TEST-- +GH-24641 (ndbm backend never checks dbm_open() return value, NULL deref on first use after a failed open) +--EXTENSIONS-- +dba +--FILE-- +<?php + +file_put_contents(__DIR__ . '/gh24641', 'not a valid ndbm/gdbm database, just plain text'); + +foreach (dba_handlers() as $handler) { + /* Suppress warnings */ + $db = @dba_open(__DIR__ . '/gh24641', 'r', $handler); + /* Expected as this file is not a proper db file */ + if ($db === false) { + continue; + } + /* Some drivers just don't care */ + dba_firstkey($db); // SEGV + dba_close($db); +} + +?> +DONE +--CLEAN-- +<?php +@unlink(__DIR__ . '/gh24641'); +@unlink(__DIR__ . '/gh24641-lock'); +?> +--EXPECT-- +DONE