Skip to content

ext/pdo_pgsql: Clear the notice callback when a persistent handle is released - #25156

Closed
iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/aph-pdo-pgsql-persistent-notice-uaf-90ax-84-work
Closed

iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/aph-pdo-pgsql-persistent-notice-uaf-90ax-84-work

Conversation

@iliaal

@iliaal iliaal commented Nov 2, 2026

Copy link
Copy Markdown
Member

Pdo\Pgsql::setNoticeCallback() keeps a request-allocated fcall cache on the driver handle, and nothing drops it when a persistent handle outlives the request, so the next request on that connection runs the freed callback as soon as it receives a notice. The persistent_shutdown hook now clears it once the last object of the request releases the handle (refcount <= 2, the check pdo_dbh_free_storage() uses before rolling back). On PHP-8.6 and master a9138d7 already applies that check in the caller, so the merge there drops the guard and adds the cleanup to the existing pdo_pgsql_request_shutdown().

…released

Pdo\Pgsql::setNoticeCallback() stores a request-allocated fcall cache on the
driver handle. A persistent handle outlives the request, so the next request
on the same connection uses freed memory as soon as it receives a notice or
sets a new callback. Drop the callback from the persistent_shutdown hook,
which pdo_sqlite also uses for its user functions, once the last object of
the request releases the handle.
@iliaal iliaal closed this in 6e6ec4b Nov 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants