dba_open() can segfault for "pathless" streams

Description

The following code:

<?php
$file = 'data:text/plain;z=y;uri=eviluri;mediatype=wut?;mediatype2=hello,somedata';
$fusion = $file;
$db = dba_open($fusion, 'c', 'inifile');

Resulted in this output:

/php-src/ext/dba/dba.c:845: void php_dba_open(zend_execute_data *, zval *, _Bool): Assertion `opened_path' failed.
Aborted (core dumped)

PHP Version

nightly

Operating System

ubuntu 22.04

php-src/ext/dba/dba.c

Lines 845 to 848 in 8953348

    
           ZEND_ASSERT(opened_path); 
        
           /* replace the path info with the real path of the opened file */ 
        
           zend_string_release_ex(connection->info->path, persistent); 
        
           connection->info->path = php_dba_zend_string_dup_safe(opened_path, persistent);

/* replace the path info with the real path of the opened file */

But we don't have a real path...

Maybe

 ext/dba/dba.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/ext/dba/dba.c b/ext/dba/dba.c
index 04cee6f385..2bd0c8292a 100644
--- a/ext/dba/dba.c
+++ b/ext/dba/dba.c
@@ -842,10 +842,13 @@ static void php_dba_open(INTERNAL_FUNCTION_PARAMETERS, bool persistent)
 			connection->info->lock.fp = php_stream_open_wrapper(lock_name, lock_file_mode, STREAM_MUST_SEEK|REPORT_ERRORS|IGNORE_PATH|persistent_flag, &opened_path);
 			if (connection->info->lock.fp) {
 				if (is_db_lock) {
-					ZEND_ASSERT(opened_path);
-					/* replace the path info with the real path of the opened file */
-					zend_string_release_ex(connection->info->path, persistent);
-					connection->info->path = php_dba_zend_string_dup_safe(opened_path, persistent);
+					if (opened_path) {
+						/* replace the path info with the real path of the opened file */
+						zend_string_release_ex(connection->info->path, persistent);
+						connection->info->path = php_dba_zend_string_dup_safe(opened_path, persistent);
+					} else {
+						zend_argument_error(…);
+					}
 				}
 			}
 			if (opened_path) {

By the way, a couple of lines below we have

php-src/ext/dba/dba.c

Lines 865 to 870 in 3351dae

    
           if (!php_stream_supports_lock(connection->info->lock.fp)) { 
        
           	error = "Stream does not support locking"; 
        
           } 
        
           if (php_stream_lock(connection->info->lock.fp, lock_mode)) { 
        
           	error = "Unable to establish lock"; /* force failure exit */ 
        
           }

It's rather unlikely that the first error message will ever show up.

Right, the patch idea makes sense.

Fix phpGH-16390: dba_open() can segfault for "pathless" streams

Fix GH-16390: dba_open() can segfault for "pathless" streams

Merge branch 'PHP-8.2' into PHP-8.3

Merge branch 'PHP-8.3' into PHP-8.4

Merge branch 'PHP-8.4'

Navigation Menu

Repository navigation

dba_open() can segfault for "pathless" streams #16390

Description

PHP Version

Operating System

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	ZEND_ASSERT(opened_path);
	/* replace the path info with the real path of the opened file */
	zend_string_release_ex(connection->info->path, persistent);
	connection->info->path = php_dba_zend_string_dup_safe(opened_path, persistent);

	if (!php_stream_supports_lock(connection->info->lock.fp)) {
	error = "Stream does not support locking";
	}
	if (php_stream_lock(connection->info->lock.fp, lock_mode)) {
	error = "Unable to establish lock"; /* force failure exit */
	}

dba_open() can segfault for "pathless" streams #16390

Description

Description

PHP Version

Operating System

Activity

ndossche commented on Oct 12, 2024

cmb69 commented on Oct 17, 2024

ndossche commented on Oct 17, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions