[php-src] PR #24339: Fix double free in ext/ftp data_accept() on accept failure
| From: | alepacheco | Date: | Thu, 15 Oct 2026 02:43:23 +0000 |
| Subject: | [php-src] PR #24339: Fix double free in ext/ftp data_accept() on accept failure | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39452@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24339
Author: alepacheco
In active mode, when the server never opens the data connection,
my_accept() fails and
data_accept() frees the databuf_t. ftp_getdata() has already
stored that buffer in ftp->data, so the caller's bail: path runs
data_close(ftp) and frees it again. Every transfer and listing function that goes
through data_accept() is affected (ftp_get(), ftp_put(),
ftp_append(), ftp_nb_get(), ftp_nb_put(),
ftp_nlist()/ftp_rawlist()/ftp_mlsd()).
The SSL failure paths in data_accept() already return without freeing and leave the
cleanup to data_close(). This makes the accept failure path do the same, so
data_close() is the only place that frees a published ftp->data.
The test adds a server.inc file name that answers RETR with 150 but never
connects back, and checks that ftp_get() and ftp_nb_get() both fail
cleanly after the timeout.
Targeting PHP-8.4 as the oldest branch with the bug in active support.