PHP  
 PHP_7_1
downloads | QA | documentation | faq | getting help | mailing lists | reporting bugs | php.net sites | links | my php.net 
 

Test Failure Report for ext/curl/tests/bug69316.phpt ('Bug #69316: Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER')

Script

1: <?php
2:   
function hdr_callback($ch$data) {
3:       
// close the stream, causing the FILE structure to be free()'d
4:       
if($GLOBALS['f_file']) {
5:           
fclose($GLOBALS['f_file']); $GLOBALS['f_file'] = 0;
6:
7:           
// cause an allocation of approx the same size as a FILE structure, size varies a bit depending on platform/libc
8:           
$FILE_size = (PHP_INT_SIZE == 0x160 0x238);
9:           
curl_setopt($chCURLOPT_COOKIEstr_repeat("a"$FILE_size 1));
10:       }
11:       return 
strlen($data);
12:   }
13:
14:   include 
'server.inc';
15:   
$host curl_cli_server_start();
16:   
$temp_file dirname(__FILE__) . '/body.tmp';
17:   
$url "{$host}/get.php?test=getpost";
18:   
$ch curl_init();
19:   
$f_file fopen($temp_file"w") or die("failed to open file\n");
20:   
curl_setopt($chCURLOPT_BUFFERSIZE10);
21:   
curl_setopt($chCURLOPT_HEADERFUNCTION"hdr_callback");
22:   
curl_setopt($chCURLOPT_FILE$f_file);
23:   
curl_setopt($chCURLOPT_URL$url);
24:   
curl_exec($ch);
25:   
curl_close($ch);
26:
?>
27:
===DONE===
28:

Expected

Warning: curl_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
array(1) {
  ["test"]=>
  string(7) "getpost"
}
array(0) {
}
===DONE===

Output

Warning: curl_exec(): CURLOPT_FILE resource has gone away, resetting to default in /var/php_gcov/PHP_7_1/ext/curl/tests/bug69316.php on line 24
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /responder/get.php was not found on this server.</p>
</body></html>
===DONE===

Diff

002+ <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
003+ <html><head>
004+ <title>404 Not Found</title>
005+ </head><body>
006+ <h1>Not Found</h1>
007+ <p>The requested URL /responder/get.php was not found on this server.</p>
008+ </body></html>
002- array(1) {
003-   ["test"]=>
004-   string(7) "getpost"
005- }
006- array(0) {
007- }

 

Generated at Sun, 23 Jun 2019 06:34:16 +0000 (3 days ago)

Copyright © 2005-2019 The PHP Group
All rights reserved.