Skip to content

Fix use-after-free of CURLOPT_STDERR stream on cloned curl handle - #24427

Closed
lacatoire wants to merge 1 commit into
php:PHP-8.4from
lacatoire:fix/curl-copy-handle-stderr-upstream
Closed

lacatoire wants to merge 1 commit into
php:PHP-8.4from
lacatoire:fix/curl-copy-handle-stderr-upstream

Conversation

@lacatoire

Copy link
Copy Markdown
Member

_php_setup_easy_copy_handlers() copies the write, read and write_header streams but not std_err. The clone never checks that the stream is still open, so libcurl keeps writing to a FILE* freed when the stream is closed.

Copy std_err like the other handlers.

@ndossche

Copy link
Copy Markdown
Member

Hey, thanks for the PR.
Since this is a bugfix, this should target the lowest supported bugfix branch where the bug is present. Could you please retarget the PR?

_php_setup_easy_copy_handlers() copies the write, read and write_header
streams but not std_err. The clone never checks that stream is still
open, so libcurl keeps writing to a FILE* freed when the stream is
closed.

Copy std_err like the other handlers.
@lacatoire
lacatoire force-pushed the fix/curl-copy-handle-stderr-upstream branch from 08b5827 to e421f82 Compare October 26, 2026 07:48
@lacatoire
lacatoire changed the base branch from master to PHP-8.4 October 26, 2026 07:48

@ndossche ndossche left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@ndossche ndossche closed this in 59f8e1d Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants