Skip to content

streams: Keep user wrappers alive across URL operations - #444

Closed
iliaal wants to merge 1 commit into
masterfrom
fix/user-wrapper-url-ops-uaf
Closed

iliaal wants to merge 1 commit into
masterfrom
fix/user-wrapper-url-ops-uaf

Conversation

@iliaal

@iliaal iliaal commented Oct 26, 2026

Copy link
Copy Markdown
Owner

A user stream wrapper whose constructor or destructor calls stream_wrapper_unregister() frees the wrapper while unlink(), rename(), mkdir(), rmdir(), touch(), chmod() or stat() is still using it, and when the method is not implemented the "is not implemented!" warning reads the freed wrapper and its class name. user_wrapper_opener() and user_wrapper_opendir() already hold a reference to the wrapper resource across the user calls; the URL operations now do the same.

This reproduces on PHP-8.4 through master under valgrind; it targets master because it needs a wrapper that unregisters itself. Found while reviewing php#24711, which fixes the separate opendir() error-report regression on PHP-8.6.

A user wrapper's constructor or destructor can unregister the wrapper while
unlink(), rename(), mkdir(), rmdir(), touch(), chmod() or stat() is using
it, which frees the wrapper, and the "is not implemented!" warning then
reads the freed wrapper and its class. Hold a reference to the wrapper
resource for the whole operation, as user_wrapper_opener() and
user_wrapper_opendir() already do.
@iliaal

iliaal commented Oct 26, 2026

Copy link
Copy Markdown
Owner Author

Promoted upstream: php#24754

@iliaal iliaal closed this Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant