archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Retain reference to share handle from curl handle

Browse source 
Not keeping a reference will not result in use after free, because
curl protects against it, but it will result in a memory leak,
because curl_share_cleanup() will fail. We should make sure that
the share handle object stays alive as long as the curl handles
use it.
This commit is contained in:
Nikita Popov 2020-11-11 11:51:20 +01:00
parent 11c4821ba9
commit b4a2a9662b
3 changed files with 42 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
ext/curl/interface.c
View file

@ -2832,6 +2832,12 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue, bool i
if (Z_TYPE_P(zvalue) == IS_OBJECT && Z_OBJCE_P(zvalue) == curl_share_ce) {
php_curlsh *sh = Z_CURL_SHARE_P(zvalue);
curl_easy_setopt(ch->cp, CURLOPT_SHARE, sh->share);
if (ch->share) {
OBJ_RELEASE(&ch->share->std);
}
GC_ADDREF(&sh->std);
ch->share = sh;
}
}
break;
@ -3373,6 +3379,10 @@ static void curl_free_obj(zend_object *object)
efree(ch->handlers);
zval_ptr_dtor(&ch->postfields);
if (ch->share) {
OBJ_RELEASE(&ch->share->std);
}
zend_object_std_dtor(&ch->std);
}
/* }}} */