memory leak curl

Description

The following code:

<?php
function hdr_callback($ch, $data) {
if($GLOBALS['f_file']) {
fclose($GLOBALS['f_file']); $GLOBALS['f_file'] = 0;
curl_setopt($ch, CURLOPT_COOKIE, str_repeat("a", $FILE_size - 1));
}
}
include 'server.inc';
$host = curl_cli_server_start();
$temp_file = __DIR__ . '/body.tmp';
$url = "{$host}/get.inc?test=getpost";
$ch = curl_init();
$f_file = fopen($temp_file, "w") or die("failed to open file\n");
curl_setopt($ch, CURLOPT_HEADERFUNCTION, "hdr_callback");
curl_setopt($ch, CURLOPT_FILE, $f_file);
curl_setopt($ch, CURLOPT_URL, $url);
curl_exec($ch);

Resulted in this output:

==3585364==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 8192 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6810bd)
    #1 0x7a5da52ffbf4 in _IO_file_doallocate libio/./libio/filedoalloc.c:101:7
    #2 0x7a5da530ecdf in _IO_doallocbuf libio/./libio/genops.c:347:9
    #3 0x7a5da530df5f in _IO_file_overflow libio/./libio/fileops.c:744:4
    #4 0x7a5da530c6d4 in _IO_new_file_xsputn libio/./libio/fileops.c:1243:11
    #5 0x7a5da530c6d4 in _IO_file_xsputn libio/./libio/fileops.c:1196:1
    #6 0x7a5da5300fd6 in fwrite libio/./libio/iofwrite.c:39:15
    #7 0x61e4af in fwrite (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x61e4af)
    #8 0xf5b6e2 in curl_write /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/curl/interface.c:540:11
    #9 0x7a5da5ae391a  (/lib/x86_64-linux-gnu/libcurl.so.4+0x5191a)
    #10 0x7a5da5af6f30  (/lib/x86_64-linux-gnu/libcurl.so.4+0x64f30)
    #11 0x7a5da5ad8233  (/lib/x86_64-linux-gnu/libcurl.so.4+0x46233)
    #12 0x7a5da5adb4cd in curl_multi_perform (/lib/x86_64-linux-gnu/libcurl.so.4+0x494cd)
    #13 0x7a5da5ab7eb2 in curl_easy_perform (/lib/x86_64-linux-gnu/libcurl.so.4+0x25eb2)
    #14 0xf3b93a in zif_curl_exec /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/curl/interface.c:2395:10
    #15 0x60230be in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:1355:2
    #16 0x5b3f75b in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:115722:12
    #17 0x5b41cec in zend_execute /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:121434:2
    #18 0x68c4e09 in zend_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1977:3
    #19 0x50a195a in php_execute_script_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2640:13
    #20 0x50a2a98 in php_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2680:9
    #21 0x68d9d1a in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:951:5
    #22 0x68d40ff in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1362:18
    #23 0x7a5da52aad8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #24 0x7a5da52aae3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #25 0x6061f4 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6061f4)

SUMMARY: AddressSanitizer: 8192 byte(s) leaked in 1 allocation(s).

To reproduce:

./php-src/sapi/cli/php  ./test.php

Commit:

e23c6222da50a2c5828a03ad701cd3351b13590d

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This report is automatically generated by FlowFusion

PHP Version

nightly

Operating System

No response

Reproduisez le rapport avec ./php-src/sapi/cli/php ./test.php en utilisant la configuration AddressSanitizer décrite. Commencez aux lignes 540 et 2395 de ext/curl/interface.c, puis suivez le chemin d’exécution de curl et d’écriture du fichier indiqué dans le rapport de fuite. Le travail est terminé lorsque la reproduction ne signale plus la fuite de 8192 octets.