Re: Severe safety fail in file access and stream filters

Hi Umberto, On Thu, Jan 21, 2016 at 10:30 AM, Umberto Salsi <salsi@icosaedro.it> wrote: > I recently discovered several failures in error detection involving > file access, stream compression and source inclusion that may bring the > program to process missing or invalid data (very severe safety bug) or > simply crash without apparent reason. I reported all these issues with > their test script trying to do as much as I can to really understand > what happen here. I think it's the time for some real internal expert > to take over these issues and kindly reply to the following questions: > > 1. Is there something very basic I'm missing? I'm doing something wrong? > > 2. If yes, what can I do to fix so that i/o errors can be detected? > > 3. If no, why i/o errors do not propagate through the engine, but are > mostly ignored? and why the user's program does not get signaled > about this, and keeps receiving empty strings or garbage instead? Plain file stream reads data by php_stdiop_read() http://lxr.php.net/xref/PHP_5_6/main/streams/plain_wrapper.c#338 As you can see there is no way to return errors from it. We need errno like error handling for PHP streams to propagate errors as well as more robust code for unexpected. So answer for 3 is "we need volunteers" for improvement, I suppose. Anyone? -- Yasuo Ohgaki yohgaki@ohgaki.net