[php-src] PR #24323: ext/curl: Guard curl_reset(), copy and clone of a denied pushed handle
| From: | iliaal | Date: | Wed, 14 Oct 2026 12:13:53 +0000 |
| Subject: | [php-src] PR #24323: ext/curl: Guard curl_reset(), copy and clone of a denied pushed handle | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39415@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24323
Author: iliaal
Depends on #23850 and is stacked on its branch, so the first commit here is that PR's; only the
second commit is new. When a CURLMOPT_PUSHFUNCTION callback keeps the pushed handle and denies the
push, libcurl frees the easy handle and the CurlHandle is left with a NULL ch->cp. curl_reset(),
curl_copy_handle() and clone pass that NULL to curl_easy_reset() and curl_easy_duphandle() and
segfault. This predates #23850 (reproduced on 57140099605); the other CurlHandle entry points
already fail cleanly without an easy handle.
The test depends on the dtor change in #23850: without it the kept handle's handlers leak and a
debug build reports it.
Not included: curl_getinfo() with CURLINFO_CERTINFO leaks the array it initialised when
curl_easy_getinfo() fails, reachable through the same kept handle. That is a separate fix.