Repository navigation
Conversation
A destructor of the old callback may register a new one, which was then overwritten and leaked.
…gh-24731-header-callback-dtor # Conflicts: # NEWS
Member
|
Is still valid on master? Also please stop adding a NEWS file. You've been told multiple times to not add it yourself. |
Contributor
Author
|
Yes, master has the same bug: |
Member
|
For whenever the zval was converted to only a FCC the fix should be done within zend_fcc_dtor as said in #24764 |
Contributor
Author
|
On 8.4 and 8.5 the callback is still a zval and not an FCC, so a zend_fcc_dtor() fix does not help there (I tried it and the test still asserts). On master I agree: drop the SAPI.c change on merge-up, because the test passes with only the zend_fcc_dtor() fix. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
header_register_callback()released the previous callback while it was still stored inSG(callback_func). If a destructor run by that release bails out (fatal error, timeout), the slot keeps pointing at the half-freed closure, and the fatal error output goes throughsapi_send_headers(), which calls and releases it a second time. The callback is now moved out of the global before it is released, likesapi_send_headers()already does.Fixes #24731