[php-src] PR #25281: Fix use-after-free when proc_open() pipe is closed from its user filter
| From: | bukka | Date: | Sat, 07 Nov 2026 11:50:05 +0000 |
| Subject: | [php-src] PR #25281: Fix use-after-free when proc_open() pipe is closed from its user filter | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40389@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25281
Author: bukka
The process resource destructor closed every pipe stream with zend_list_close(), regardless of
whether a user filter callback was running on it. Both proc_close() and releasing the last reference
to the process from inside such a callback freed the pipe stream and the filter under the running
callback.
The destructor now only drops its reference to a pipe stream marked PHP_STREAM_FLAG_NO_FCLOSE, so
the stream closes with its last reference instead. proc_close() additionally refuses to close the
process while one of its pipes carries that flag, since waiting for the child with the pipe still
open could deadlock. It warns and returns -1, its documented error value, like pclose() does for
such a stream.