Skip to content

Fix GH-24748: socket_set_option() crash with declared object properties #24749

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
lazerg wants to merge 6 commits into from
Closed

Fix GH-24748: socket_set_option() crash with declared object properties #24749

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d816e1e
Fix GH-24748: socket_set_option() crash with declared object properties
lazerg Oct 26, 2026
1e99a2a
Read each socket option value before looking up the next one
lazerg Oct 26, 2026
37088c0
Keep the object property table alive while reading socket option values
lazerg Oct 26, 2026
dfd1211
Only compare l_linger in the GH-24748 test, BSD reports l_onoff as 128
lazerg Oct 26, 2026
2f771be
Fall back to an empty table when an object has no properties table
lazerg Oct 26, 2026
312d69e
Use the l_linger key name in the SO_LINGER range error, drop NEWS entry
lazerg Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 16 additions & 8 deletions ext/sockets/sockets.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1881,7 +1881,7 @@ PHP_FUNCTION(socket_set_option)
#endif
zend_long level, optname;
void *opt_ptr;
HashTable *opt_ht;
HashTable *opt_ht, *opt_props = NULL;
zval *l_onoff, *l_linger;
zval *sec, *usec;

Expand Down Expand Up @@ -1955,31 +1955,35 @@ PHP_FUNCTION(socket_set_option)
zend_argument_type_error(4, "must be of type array when argument #3 ($option) is SO_LINGER, %s given", zend_zval_value_name(arg4));
RETURN_THROWS();
} else {
opt_ht = Z_OBJPROP_P(arg4);
opt_props = zend_get_properties_for(arg4, ZEND_PROP_PURPOSE_ARRAY_CAST);
opt_ht = opt_props ? opt_props : (HashTable *) &zend_empty_array;
}
} else {
opt_ht = Z_ARRVAL_P(arg4);
}

if ((l_onoff = zend_hash_str_find(opt_ht, l_onoff_key, sizeof(l_onoff_key) - 1)) == NULL) {
if ((l_onoff = zend_hash_str_find_ind(opt_ht, l_onoff_key, sizeof(l_onoff_key) - 1)) == NULL) {
zend_release_properties(opt_props);
zend_argument_value_error(4, "must have key \"%s\"", l_onoff_key);
RETURN_THROWS();
}
if ((l_linger = zend_hash_str_find(opt_ht, l_linger_key, sizeof(l_linger_key) - 1)) == NULL) {
if ((l_linger = zend_hash_str_find_ind(opt_ht, l_linger_key, sizeof(l_linger_key) - 1)) == NULL) {
zend_release_properties(opt_props);
zend_argument_value_error(4, "must have key \"%s\"", l_linger_key);
RETURN_THROWS();
}

zend_long val_lonoff = zval_get_long(l_onoff);
zend_long val_linger = zval_get_long(l_linger);
zend_release_properties(opt_props);

@iliaal iliaal Oct 27, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

zend_get_properties_for(..., ZEND_PROP_PURPOSE_ARRAY_CAST) can return a temporary table (for example, ArrayObject returns a duplicate). This release destroys that table, but the subsequent linger range-error formatter still passes l_linger to %s, causing a use-after-free read.

The incorrect format argument predates this PR; freeing its backing table before formatting introduces the lifetime defect. Please pass l_linger_key instead of l_linger to zend_argument_value_error() and add regression coverage for this validation path with a temporary property table.

@lazerg lazerg Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 312d69e. The error now uses l_linger_key, and gh24748.phpt covers it with an out-of-range ArrayObject.


if (val_lonoff < 0 || val_lonoff > USHRT_MAX) {
zend_argument_value_error(4, "\"%s\" must be between 0 and %u", l_onoff_key, USHRT_MAX);
RETURN_THROWS();
}

if (val_linger < 0 || val_linger > USHRT_MAX) {
zend_argument_value_error(4, "\"%s\" must be between 0 and %d", l_linger, USHRT_MAX);
zend_argument_value_error(4, "\"%s\" must be between 0 and %d", l_linger_key, USHRT_MAX);
RETURN_THROWS();
}

Expand All @@ -2003,23 +2007,27 @@ PHP_FUNCTION(socket_set_option)
zend_zval_value_name(arg4));
RETURN_THROWS();
} else {
opt_ht = Z_OBJPROP_P(arg4);
opt_props = zend_get_properties_for(arg4, ZEND_PROP_PURPOSE_ARRAY_CAST);
opt_ht = opt_props ? opt_props : (HashTable *) &zend_empty_array;
}
} else {
opt_ht = Z_ARRVAL_P(arg4);
}

if ((sec = zend_hash_str_find(opt_ht, sec_key, sizeof(sec_key) - 1)) == NULL) {
if ((sec = zend_hash_str_find_ind(opt_ht, sec_key, sizeof(sec_key) - 1)) == NULL) {
zend_release_properties(opt_props);
zend_argument_value_error(4, "must have key \"%s\"", sec_key);
RETURN_THROWS();
}
if ((usec = zend_hash_str_find(opt_ht, usec_key, sizeof(usec_key) - 1)) == NULL) {
if ((usec = zend_hash_str_find_ind(opt_ht, usec_key, sizeof(usec_key) - 1)) == NULL) {
zend_release_properties(opt_props);
zend_argument_value_error(4, "must have key \"%s\"", usec_key);
RETURN_THROWS();
}

zend_long valsec = zval_get_long(sec);
zend_long valusec = zval_get_long(usec);
zend_release_properties(opt_props);
#ifndef PHP_WIN32
tv.tv_sec = valsec;
tv.tv_usec = valusec;
Expand Down
64 changes: 64 additions & 0 deletions ext/sockets/tests/gh24748.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,64 @@
--TEST--
GH-24748 (socket_set_option() crashes when the value is an object with declared properties)
--EXTENSIONS--
sockets
--FILE--
<?php
class Linger {
public $l_onoff = 1;
public $l_linger = 5;
}

class Timeout {
public $sec = 1;
public int $usec;
}

$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
var_dump(socket_set_option($socket, SOL_SOCKET, SO_LINGER, new Linger()));
var_dump(socket_get_option($socket, SOL_SOCKET, SO_LINGER)["l_linger"]);

try {
socket_set_option($socket, SOL_SOCKET, SO_RCVTIMEO, new Timeout());
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}

$timeout = new Timeout();
$timeout->usec = 0;
var_dump(socket_set_option($socket, SOL_SOCKET, SO_RCVTIMEO, $timeout));
var_dump(socket_set_option($socket, SOL_SOCKET, SO_SNDTIMEO, $timeout));
var_dump(socket_get_option($socket, SOL_SOCKET, SO_SNDTIMEO));

$linger = new stdClass();
$linger->l_onoff = new stdClass();
$linger->l_linger = 5;
set_error_handler(function () use ($linger) {
$tmp = (array) $linger;
$linger->extra = 1;
unset($tmp);
return true;
});
var_dump(socket_set_option($socket, SOL_SOCKET, SO_LINGER, $linger));
restore_error_handler();

try {
socket_set_option($socket, SOL_SOCKET, SO_LINGER, new ArrayObject(['l_onoff' => 1, 'l_linger' => 70000]));
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
bool(true)
int(5)
socket_set_option(): Argument #4 ($value) must have key "usec"
bool(true)
bool(true)
array(2) {
["sec"]=>
int(1)
["usec"]=>
int(0)
}
bool(true)
socket_set_option(): Argument #4 ($value) "l_linger" must be between 0 and 65535
Loading