1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
--TEST--
Bug #52820 (writes to fopencookie FILE* not committed when seeking the stream)
--SKIPIF--
<?php
if (!function_exists('leak_variable'))
die("skip only for debug builds");
/* unfortunately no standard function does a cast to FILE*, so we need
* curl to test this */
if (!extension_loaded("curl")) exit("skip curl extension not loaded");
$handle=curl_init('http://127.0.0.1:37349/');
curl_setopt($handle, CURLOPT_VERBOSE, true);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
if (!curl_setopt($handle, CURLOPT_STDERR, fopen("php://memory", "w+")))
die("skip fopencookie not supported on this platform");
--FILE--
<?php
function do_stuff($url) {
$handle=curl_init('http://127.0.0.1:37349/');
curl_setopt($handle, CURLOPT_VERBOSE, true);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
curl_setopt($handle, CURLOPT_STDERR, $o = fopen($url, "w+"));
curl_exec($handle);
echo "About to rewind!\n";
rewind($o);
echo stream_get_contents($o);
return $o;
}
echo "temp stream (close after):\n";
fclose(do_stuff("php://temp"));
echo "\nmemory stream (close after):\n";
fclose(do_stuff("php://memory"));
echo "\ntemp stream (leak):\n";
leak_variable(do_stuff("php://temp"), true);
echo "\nmemory stream (leak):\n";
leak_variable(do_stuff("php://memory"), true);
echo "\nDone.\n";
--EXPECTF--
temp stream (close after):
About to rewind!
* About to connect() to 127.0.0.1 port 37349%r.*%r
* Trying 127.0.0.1...%A* Connection refused
* couldn't connect to host%S
* Closing connection #0
memory stream (close after):
About to rewind!
* About to connect() to 127.0.0.1 port 37349%r.*%r
* Trying 127.0.0.1...%A* Connection refused
* couldn't connect to host%S
* Closing connection #0
temp stream (leak):
About to rewind!
* About to connect() to 127.0.0.1 port 37349%r.*%r
* Trying 127.0.0.1...%A* Connection refused
* couldn't connect to host%S
* Closing connection #0
memory stream (leak):
About to rewind!
* About to connect() to 127.0.0.1 port 37349%r.*%r
* Trying 127.0.0.1...%A* Connection refused
* couldn't connect to host%S
* Closing connection #0
Done.
|
