[php-src] PR #25209: Fix dangling context in ldap_set_rebind_proc()
| From: | lacatoire | Date: | Thu, 05 Nov 2026 13:54:17 +0000 |
| Subject: | [php-src] PR #25209: Fix dangling context in ldap_set_rebind_proc() | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40323@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25209
Author: lacatoire
ldap_set_rebind_proc() passed a pointer to its own argument slot as the callback
context, which is stale once a referral is chased later. Pass the ldap_linkdata
instead.
### To reproduce
With a server answering dc=ref with a referral:
```php
<?php
function cb($conn, $url) { echo "callback: ", get_class($conn), " $url\n";
return 0; }
function setup($l) { ldap_set_rebind_proc($l, 'cb'); }
function deeper($l, $d) { return $d > 0 ? deeper($l, $d - 1) : ldap_read($l, "dc=ref",
"(objectClass=*)", ["cn"]); }
$l = ldap_connect("ldap://127.0.0.1:3899");
ldap_set_option($l, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_bind($l);
ldap_set_option($l, LDAP_OPT_REFERRALS, 1);
setup($l);
var_dump(deeper($l, 6));
```
Before (ASAN build): SEGV in _ldap_rebind_proc
After: callback: LDAP\Connection ldap://localhost:3899/dc=x