Skip to content

ext/dba: Fix request memory kept in persistent dba handles - #25155

Open
iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/aph-dba-flatfile-request-allocation-7x8y-84-work
Open

iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/aph-dba-flatfile-request-allocation-7x8y-84-work

Conversation

@iliaal

@iliaal iliaal commented Nov 2, 2026

Copy link
Copy Markdown
Member

A dba_popen() handle outlives the request, but flatfile kept its last key buffer, inifile its current and last-fetched lines, and cdb_make its hash list in it as emalloc'd memory that the next request or the shutdown-time close then freed or read. flatfile now frees the key right away and uses its file position as the iteration marker; inifile and cdb_make allocate what they keep with the handle's persistence. cdb (read), lmdb, db1-db4, dbm, ndbm, gdbm, qdbm and tcadb keep only offsets, library cursors or malloc()ed buffers between calls.

A dba_popen() handle outlives the request, but flatfile kept the buffer of
the last returned key, inifile its current and last-fetched lines, and
cdb_make its hash list in it as emalloc'd memory, which the next request or
the close at shutdown then freed or read. flatfile now frees the key right
away and uses its file position as the iteration marker; inifile and
cdb_make allocate what they keep with the persistence of the handle.
@Girgias

Girgias commented Nov 8, 2026

Copy link
Copy Markdown
Member

There are frankly bigger problems with DBA persistent handlers considering PHP_FUNCTION(dba_close) passes a NULL pointer to zend_hash_apply_with_argument (as connection->info is freed in dba_close_connection()).

@iliaal

iliaal commented Nov 8, 2026

Copy link
Copy Markdown
Member Author

Indeed, connection->info is already NULL there, so the persistent handle stays open, lock included. Passing the saved pointer instead segfaults dba015.phpt, since two dba_popen() objects share the entry, so it needs a refcount. I'll send that separately.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants