Repository navigation
Conversation
ftp_nb_get() aborts a pending non-blocking transfer before it starts a new one; ftp_nb_put() did not. ftp_getdata() assigns ftp->data unconditionally, so every ftp_nb_put()/ftp_nb_fput() issued while a transfer was still pending replaced the pointer to the previous databuf_t, leaking it together with its socket, and read the pending transfer's response as the answer to its own command. The guard was added to the GET path by c962a96 (phpGH-10562, "Memory leak and invalid state with consecutive ftp_nb_fget") and was never applied to the PUT path. It is missing there on every branch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
ftp_nb_get()aborts a pending non-blocking transfer before starting a new one.ftp_nb_put()does not.ftp_getdata()assignsftp->dataunconditionally, so eachftp_nb_put()/ftp_nb_fput()issued while a transfer is pending replaces the pointer to theprevious
databuf_t, leaking it with its socket, and reads the pending transfer's response asthe answer to its own command.
The guard was added to the GET path by c962a96 (GH-10562, "Memory leak and invalid state
with consecutive
ftp_nb_fget") and never applied to the PUT path. It is absent there on everybranch from PHP-8.2 to master.
Measured
Starting one non-blocking download and then five non-blocking uploads, counting the process's
own sockets through
/proc/self/fd:The second line is what the guarded sibling
ftp_nb_fget()already does with the same serverand the same loop.
Test
ext/ftp/tests/ftp_nb_put_during_nb_transfer.phptleaves a transfer pending withftp_nb_fget()and then uploads. It fails without the change and passes with it. The fullext/ftpsuite is unaffected: 62 passed, 0 failed, 4 skipped.🤖 Generated with Claude Code