[php-src] master: Merge branch 'PHP-8.5' into PHP-8.6

Author: Gina Peter Banyard (Girgias) Date: 2026-10-24T17:43:45+01:00 Commit: https://github.com/php/php-src/commit/c1667ca5a6ce6d4279d3643a863bd4d58f8cac2e Raw diff: https://github.com/php/php-src/commit/c1667ca5a6ce6d4279d3643a863bd4d58f8cac2e.diff Merge branch 'PHP-8.5' into PHP-8.6 * PHP-8.5: dba: fix GH-24641 (NULL dereferencement with ndbm backend) Changed paths: A ext/dba/tests/gh24641.phpt M NEWS M ext/dba/dba_ndbm.c Diff: diff --git a/NEWS b/NEWS index d42b8ee88f32..cc1a91395056 100644 --- a/NEWS +++ b/NEWS @@ -6,6 +6,10 @@ PHP NEWS . Fix function and constant imports in compile_to_ast and add support for grouping. (Klaas Skelte van der Werf) +- DBA: + . Fixed bug GH-24641 (ndbm backend never checks dbm_open() return value, + NULL deref on first use after a failed open). (Girgias) + - Hash: . Fix GOST and Snefru digests of 512 MiB or more. (Martin Mirchev) diff --git a/ext/dba/dba_ndbm.c b/ext/dba/dba_ndbm.c index c60ab7e5f428..8fd563857fd5 100644 --- a/ext/dba/dba_ndbm.c +++ b/ext/dba/dba_ndbm.c @@ -51,6 +51,9 @@ DBA_OPEN_FUNC(ndbm) } dbf = dbm_open(ZSTR_VAL(info->path), gmode, filemode); + if (dbf == NULL) { + return FAILURE; + } pinfo->dbf = dbf; return SUCCESS; diff --git a/ext/dba/tests/gh24641.phpt b/ext/dba/tests/gh24641.phpt new file mode 100644 index 000000000000..e7479b64333c --- /dev/null +++ b/ext/dba/tests/gh24641.phpt @@ -0,0 +1,30 @@ +--TEST-- +GH-24641 (ndbm backend never checks dbm_open() return value, NULL deref on first use after a failed open) +--EXTENSIONS-- +dba +--FILE-- +<?php + +file_put_contents(__DIR__ . '/gh24641', 'not a valid ndbm/gdbm database, just plain text'); + +foreach (dba_handlers() as $handler) { + /* Suppress warnings */ + $db = @dba_open(__DIR__ . '/gh24641', 'r', $handler); + /* Expected as this file is not a proper db file */ + if ($db === false) { + continue; + } + /* Some drivers just don't care */ + dba_firstkey($db); // SEGV + dba_close($db); +} + +?> +DONE +--CLEAN-- +<?php +@unlink(__DIR__ . '/gh24641'); +@unlink(__DIR__ . '/gh24641-lock'); +?> +--EXPECT-- +DONE