|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #40098 php_fopen_primary_script() not thread safe
Submitted: 2007-01-11 11:59 UTC Modified: 2007-01-12 14:35 UTC
From: wharmby at uk dot ibm dot com Assigned: iliaa (profile)
Status: Closed Package: Streams related
PHP Version: 5CVS-2007-01-11 (snap) OS: Linux RHEL4
Private report: No CVE-ID: None
 [2007-01-11 11:59 UTC] wharmby at uk dot ibm dot com
The current implementation of php_fopen_primary_script()
uses the non-reentrant getpwnam() rather than the re-entrant
getpwnam_r(). Therefore calling it on a Linux ZTS enabled 
build could lead to unpredictable/undesirable results. The 
code should use the re-entrant version if it is available.

The following patch which were built against the latest snapshot (Jan 11 2007, 0730 GMT)  modifies the code in 
main/fopen_wrappers.c to use the re-entrant getpwnam_r if 
its available:

Fix tested on Linux RHEL4 with Apache 2.0.52 and user_dir set in php.ini The modified code was then driven by specifying the ~user_id in the URL e.g   


Reproduce code:
Problem found by code inspection. As with most thread safety
issues difficult to produce a simple testcase which will show
a reproducible crash but current Linux executable is clearly 
not reentrant and therefore not thread safe.

Expected result:

Actual result:


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2007-01-12 01:46 UTC]
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
Thank you for the report, and for helping us make PHP better.

 [2007-01-12 08:57 UTC] wharmby at uk dot ibm dot com
Hi Ilia
	Thanks for applying the fix for this defect.
However, in adjusting the fix to deal with the SYSCONF 
errors I believe you have introduced a storage leak.
The code as it stands does not free "pwbuf" if the call to getpwnam_r is successful after it has finished extracting the data from it.

Here is a patch for the missing code built against latest
snapshot for 5.2:

 [2007-01-12 09:10 UTC]
Fixed in CVS, thanks.
 [2007-01-12 14:26 UTC] wharmby at uk dot ibm dot com
Sorry but having now picked up latest snapshot (Jan 12 2007, 1330 GMT) and tried to rebuild on Linux it I get 2 compile errors in fopen_wrappers.c and safe_mode.c after changes dropped under this defect.

Required patch for fopen_warppers.c is

and for safe_mode.c

 [2007-01-12 14:35 UTC]
Fixed in CVS, thanks :)
 [2007-01-12 14:35 UTC]
The typo was fixed earlier, the missing var declaration is now fixed too.
 [2007-01-12 14:35 UTC] wharmby at uk dot ibm dot com
Correction: safe_mode.c already fixed in 1330 GMT snap; just the error in fopen_warppers remains.
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat May 18 17:01:33 2024 UTC