diff options
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/curl/multi.c | 1 | ||||
| -rw-r--r-- | ext/curl/tests/bug76675.phpt | 53 |
3 files changed, 57 insertions, 0 deletions
@@ -17,6 +17,9 @@ PHP NEWS . Fixed bug #77447 (PHP 7.3 built with ASAN crashes in zend_cpu_supports_avx2). (Nikita) +- Curl: + . Fixed bug #76675 (Segfault with H2 server push). (Pedro Magalhães) + - Fileinfo: . Fixed bug #77346 (webm files incorrectly detected as application/octet-stream). (Anatol) diff --git a/ext/curl/multi.c b/ext/curl/multi.c index b65ca89132..1dd3122dcc 100644 --- a/ext/curl/multi.c +++ b/ext/curl/multi.c @@ -502,6 +502,7 @@ static int _php_server_push_callback(CURL *parent_ch, CURL *easy, size_t num_hea Z_ADDREF_P(pz_parent_ch); res = zend_register_resource(ch, le_curl); + ch->res = res; ZVAL_RES(&pz_ch, res); size_t i; diff --git a/ext/curl/tests/bug76675.phpt b/ext/curl/tests/bug76675.phpt new file mode 100644 index 0000000000..5e60c5c47f --- /dev/null +++ b/ext/curl/tests/bug76675.phpt @@ -0,0 +1,53 @@ +--TEST-- +Bug #76675 (Segfault with H2 server push write/writeheader handlers) +--SKIPIF-- +<?php +include 'skipif.inc'; +if (getenv("SKIP_ONLINE_TESTS")) { + die("skip online test"); +} +$curl_version = curl_version(); +if ($curl_version['version_number'] < 0x073d00) { + exit("skip: test may crash with curl < 7.61.0"); +} +?> +--FILE-- +<?php +$transfers = 1; +$callback = function($parent, $passed) use (&$transfers) { + curl_setopt($passed, CURLOPT_WRITEFUNCTION, function ($ch, $data) { + echo "Received ".strlen($data); + return strlen($data); + }); + $transfers++; + return CURL_PUSH_OK; +}; +$mh = curl_multi_init(); +curl_multi_setopt($mh, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX); +curl_multi_setopt($mh, CURLMOPT_PUSHFUNCTION, $callback); +$ch = curl_init(); +curl_setopt($ch, CURLOPT_URL, 'https://http2.golang.org/serverpush'); +curl_setopt($ch, CURLOPT_HTTP_VERSION, 3); +curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); +curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); +curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); +curl_multi_add_handle($mh, $ch); +$active = null; +do { + $status = curl_multi_exec($mh, $active); + do { + $info = curl_multi_info_read($mh); + if (false !== $info && $info['msg'] == CURLMSG_DONE) { + $handle = $info['handle']; + if ($handle !== null) { + $transfers--; + curl_multi_remove_handle($mh, $handle); + curl_close($handle); + } + } + } while ($info); +} while ($transfers); +curl_multi_close($mh); +?> +--EXPECTREGEX-- +(Received \d+)+ |