BugFix#28868: Wrapper hash not thread-safe.

Userdefined wrappers were being registered into a global wrapper hash
which can cross threads.  Termination of once instance then has the
potential to leave an active stream in another instance with no wrapper
leading to segfault.

5 files changed, 36 insertions, 7 deletions

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index 9b61526537..970c962848 100644
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -1160,6 +1160,9 @@ PHP_RINIT_FUNCTION(basic)
 	/* Setup default context */
 	FG(default_context) = NULL;
 
+	/* Default to global wrappers only */
+	FG(stream_wrappers) = NULL;
+
 	return SUCCESS;
 }
 
@@ -1197,6 +1200,12 @@ PHP_RSHUTDOWN_FUNCTION(basic)
 		BG(user_tick_functions) = NULL;
 	}
 
+	if (FG(stream_wrappers)) {
+		zend_hash_destroy(FG(stream_wrappers));
+		efree(FG(stream_wrappers));
+		FG(stream_wrappers) = NULL;
+	}
+
 	PHP_RSHUTDOWN(user_filters)(SHUTDOWN_FUNC_ARGS_PASSTHRU);
 	
 	return SUCCESS;
diff --git a/ext/standard/file.h b/ext/standard/file.h
index 55d3660012..aba42e01bb 100644
--- a/ext/standard/file.h
+++ b/ext/standard/file.h
@@ -113,6 +113,7 @@ typedef struct {
 	char *user_agent;
 	char *user_stream_current_filename; /* for simple recursion protection */
 	php_stream_context *default_context;
+	HashTable *stream_wrappers;			/* per-request copy of url_stream_wrappers_hash */
 } php_file_globals;
 
 #ifdef ZTS
diff --git a/main/php_streams.h b/main/php_streams.h
index 586148f3c6..f3461bbd7b 100755
--- a/main/php_streams.h
+++ b/main/php_streams.h
@@ -509,6 +509,7 @@ PHP_RSHUTDOWN_FUNCTION(streams);
 BEGIN_EXTERN_C()
 PHPAPI int php_register_url_stream_wrapper(char *protocol, php_stream_wrapper *wrapper TSRMLS_DC);
 PHPAPI int php_unregister_url_stream_wrapper(char *protocol TSRMLS_DC);
+PHPAPI int php_register_url_stream_wrapper_volatile(char *protocol, php_stream_wrapper *wrapper TSRMLS_DC);
 PHPAPI php_stream *_php_stream_open_wrapper_ex(char *path, char *mode, int options, char **opened_path, php_stream_context *context STREAMS_DC TSRMLS_DC);
 PHPAPI php_stream_wrapper *php_stream_locate_url_wrapper(const char *path, char **path_for_open, int options TSRMLS_DC);
 PHPAPI char *php_stream_locate_eol(php_stream *stream, char *buf, size_t buf_len TSRMLS_DC);
@@ -538,7 +539,8 @@ PHPAPI int _php_stream_make_seekable(php_stream *origstream, php_stream **newstr
 #define php_stream_make_seekable(origstream, newstream, flags)	_php_stream_make_seekable((origstream), (newstream), (flags) STREAMS_CC TSRMLS_CC)
 
 /* Give other modules access to the url_stream_wrappers_hash and stream_filters_hash */
-PHPAPI HashTable *php_stream_get_url_stream_wrappers_hash();
+PHPAPI HashTable *_php_stream_get_url_stream_wrappers_hash(TSRMLS_D);
+#define php_stream_get_url_stream_wrappers_hash()	_php_stream_get_url_stream_wrappers_hash(TSRMLS_C)
 PHPAPI HashTable *php_get_stream_filters_hash();
 END_EXTERN_C()
 #endif
diff --git a/main/streams/streams.c b/main/streams/streams.c
index df5b506029..7b3439b428 100755
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -34,6 +34,7 @@
 #include "php_streams_int.h"
 
 /* {{{ resource and registration code */
+/* Global wrapper hash, copied to FG(stream_wrappers) on registration of volatile wrapper */
 static HashTable url_stream_wrappers_hash;
 static int le_stream = FAILURE; /* true global */
 static int le_pstream = FAILURE; /* true global */
@@ -48,9 +49,9 @@ PHPAPI int php_file_le_pstream(void)
 	return le_pstream;
 }
 
-PHPAPI HashTable *php_stream_get_url_stream_wrappers_hash()
+PHPAPI HashTable *_php_stream_get_url_stream_wrappers_hash(TSRMLS_D)
 {
-	return &url_stream_wrappers_hash;
+	return (FG(stream_wrappers) ? FG(stream_wrappers) : &url_stream_wrappers_hash);
 }
 
 static int _php_stream_release_context(list_entry *le, void *pContext TSRMLS_DC)
@@ -1374,6 +1375,7 @@ int php_shutdown_stream_wrappers(int module_number TSRMLS_DC)
 	return SUCCESS;
 }
 
+/* API for registering GLOBAL wrappers */
 PHPAPI int php_register_url_stream_wrapper(char *protocol, php_stream_wrapper *wrapper TSRMLS_DC)
 {
 	return zend_hash_add(&url_stream_wrappers_hash, protocol, strlen(protocol), wrapper, sizeof(*wrapper), NULL);
@@ -1383,11 +1385,27 @@ PHPAPI int php_unregister_url_stream_wrapper(char *protocol TSRMLS_DC)
 {
 	return zend_hash_del(&url_stream_wrappers_hash, protocol, strlen(protocol));
 }
+
+/* API for registering VOLATILE wrappers */
+PHPAPI int php_register_url_stream_wrapper_volatile(char *protocol, php_stream_wrapper *wrapper TSRMLS_DC)
+{
+	if (!FG(stream_wrappers)) {
+		php_stream_wrapper tmpwrapper;
+
+		FG(stream_wrappers) = emalloc(sizeof(HashTable));
+		zend_hash_init(FG(stream_wrappers), 0, NULL, NULL, 1);
+		zend_hash_copy(FG(stream_wrappers), &url_stream_wrappers_hash, NULL, &tmpwrapper, sizeof(php_stream_wrapper));
+	}
+
+	return zend_hash_add(FG(stream_wrappers), protocol, strlen(protocol), wrapper, sizeof(*wrapper), NULL);
+}
+
 /* }}} */
 
 /* {{{ php_stream_locate_url_wrapper */
 PHPAPI php_stream_wrapper *php_stream_locate_url_wrapper(const char *path, char **path_for_open, int options TSRMLS_DC)
 {
+	HashTable *wrapper_hash = (FG(stream_wrappers) ? FG(stream_wrappers) : &url_stream_wrappers_hash);
 	php_stream_wrapper *wrapper = NULL;
 	const char *p, *protocol = NULL;
 	int n = 0;
@@ -1414,7 +1432,7 @@ PHPAPI php_stream_wrapper *php_stream_locate_url_wrapper(const char *path, char
 	}
 
 	if (protocol)	{
-		if (FAILURE == zend_hash_find(&url_stream_wrappers_hash, (char*)protocol, n, (void**)&wrapper))	{
+		if (FAILURE == zend_hash_find(wrapper_hash, (char*)protocol, n, (void**)&wrapper))	{
 			char wrapper_name[32];
 
 			if (n >= sizeof(wrapper_name))
diff --git a/main/streams/userspace.c b/main/streams/userspace.c
index cec3fbee37..7bf7801d2f 100644
--- a/main/streams/userspace.c
+++ b/main/streams/userspace.c
@@ -59,7 +59,6 @@ static void stream_wrapper_dtor(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 {
 	struct php_user_stream_wrapper * uwrap = (struct php_user_stream_wrapper*)rsrc->ptr;
 
-	php_unregister_url_stream_wrapper(uwrap->protoname TSRMLS_CC);
 	efree(uwrap->protoname);
 	efree(uwrap->classname);
 	efree(uwrap);
@@ -415,10 +414,10 @@ PHP_FUNCTION(stream_wrapper_register)
 	uwrap->wrapper.abstract = uwrap;
 
 	rsrc_id = ZEND_REGISTER_RESOURCE(NULL, uwrap, le_protocols);
-	
+
 	if (zend_lookup_class(uwrap->classname, classname_len, (zend_class_entry***)&uwrap->ce TSRMLS_CC) == SUCCESS) {
 		uwrap->ce = *(zend_class_entry**)uwrap->ce;
-		if (php_register_url_stream_wrapper(protocol, &uwrap->wrapper TSRMLS_CC) == SUCCESS) {
+		if (php_register_url_stream_wrapper_volatile(protocol, &uwrap->wrapper TSRMLS_CC) == SUCCESS) {
 			RETURN_TRUE;
 		} else {
 			/* We failed.  But why? */