|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #79905 fopen() read-only streams in write mode doesn't fail
Submitted: 2020-07-28 11:37 UTC Modified: 2020-07-30 12:56 UTC
Avg. Score:4.5 ± 0.5
Reproduced:2 of 2 (100.0%)
Same Version:2 (100.0%)
Same OS:2 (100.0%)
From: chokolatrix at gmail dot com Assigned:
Status: Open Package: Filesystem function related
PHP Version: 7.4.8 OS: WINDOWS
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: chokolatrix at gmail dot com
New email:
PHP Version: OS:


 [2020-07-28 11:37 UTC] chokolatrix at gmail dot com
PHP's fopen() should fail to:
- open read-only streams in write mode (STDIO in 'w' or other write modes)
- open write-only streams in read mode (STDOUT, STDERR etc. in 'r' or other read modes)

This was noticed because of Laravel's logging to stderr failing under Apache/2.4.29 (Win64) mod_fcgid/2.3.9 and PHP 7.4.8 x64 NTS. 

There is possibly a bug with Apache and FastCGI exposing STDERR as non-writable (normally writes STDERR to the error log), but Laravel logging code checks fopen() result being a stream before writing to it.

Test script:
# c:\my-site\test.php


$fp = fopen('php://stdin', 'w');

$fp = fopen('php://stderr', 'r');

if ($fp) {
    // this then fails on Apache + FastCGI - might be an Apache + FCGI bug causing stderr not to be writable
    fwrite($fp, "test");

Expected result:

Actual result:
Notice: fwrite(): write of 4 bytes failed with errno=9 Bad file descriptor in test.php on line 7

resource(3) of type (stream)
resource(4) of type (stream)


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2020-07-28 12:08 UTC] chokolatrix at gmail dot com
 [2020-07-30 12:56 UTC]
The fact that opening the 'output', 'input', 'stdin', 'stderr' and
'fd' protocols completly ignores the given $mode[1], looks
actually wrong to me.

However, on Windows with IIS *F*CGI there is usually no stderr
(nor stdout for that matter); all communication with the Webserver
is done through a pipe.  The fact that PHP allows to open
php://stderr is certainly a bug in this case.

[1] <>
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Sun Sep 26 04:03:36 2021 UTC