[php-src] PR #24339: Fix double free in ext/ftp data_accept() on accept failure

From: Date: Thu, 15 Oct 2026 02:43:23 +0000
Subject: [php-src] PR #24339: Fix double free in ext/ftp data_accept() on accept failure
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39452@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24339 Author: alepacheco In active mode, when the server never opens the data connection, my_accept() fails and data_accept() frees the databuf_t. ftp_getdata() has already stored that buffer in ftp->data, so the caller's bail: path runs data_close(ftp) and frees it again. Every transfer and listing function that goes through data_accept() is affected (ftp_get(), ftp_put(), ftp_append(), ftp_nb_get(), ftp_nb_put(), ftp_nlist()/ftp_rawlist()/ftp_mlsd()). The SSL failure paths in data_accept() already return without freeing and leave the cleanup to data_close(). This makes the accept failure path do the same, so data_close() is the only place that frees a published ftp->data. The test adds a server.inc file name that answers RETR with 150 but never connects back, and checks that ftp_get() and ftp_nb_get() both fail cleanly after the timeout. Targeting PHP-8.4 as the oldest branch with the bug in active support.

« previous php.git-pulls (#39452) next »