[php-src] PR #25281: Fix use-after-free when proc_open() pipe is closed from its user filter

From: Date: Sat, 07 Nov 2026 11:50:05 +0000
Subject: [php-src] PR #25281: Fix use-after-free when proc_open() pipe is closed from its user filter
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-40389@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/25281 Author: bukka The process resource destructor closed every pipe stream with zend_list_close(), regardless of whether a user filter callback was running on it. Both proc_close() and releasing the last reference to the process from inside such a callback freed the pipe stream and the filter under the running callback. The destructor now only drops its reference to a pipe stream marked PHP_STREAM_FLAG_NO_FCLOSE, so the stream closes with its last reference instead. proc_close() additionally refuses to close the process while one of its pipes carries that flag, since waiting for the child with the pipe still open could deadlock. It warns and returns -1, its documented error value, like pclose() does for such a stream.

« previous php.git-pulls (#40389) next »