Skip to content

Fix use-after-free of CURLOPT_STDERR stream on cloned curl handle - #24427

Open
lacatoire wants to merge 1 commit into
php:masterfrom
lacatoire:fix/curl-copy-handle-stderr-upstream
Open

lacatoire wants to merge 1 commit into
php:masterfrom
lacatoire:fix/curl-copy-handle-stderr-upstream

Conversation

@lacatoire

Copy link
Copy Markdown
Member

_php_setup_easy_copy_handlers() copies the write, read and write_header streams but not std_err. The clone never checks that the stream is still open, so libcurl keeps writing to a FILE* freed when the stream is closed.

Copy std_err like the other handlers.

_php_setup_easy_copy_handlers() copies the write, read and write_header
streams but not std_err. The clone never checks that stream is still
open, so libcurl keeps writing to a FILE* freed when the stream is
closed.

Copy std_err like the other handlers.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant