|
| 1 | +--TEST-- |
| 2 | +curl_multi cleanup via GC should not cause use-after-free |
| 3 | +--DESCRIPTION-- |
| 4 | +When a CurlMultiHandle is destroyed by GC (without explicit curl_multi_close), |
| 5 | +curl_multi_cleanup() internally calls the socket callback (multi_socket_cb) |
| 6 | +for connection teardown. If the async event was already freed by curl_async_dtor, |
| 7 | +this causes a heap-use-after-free on the poll_list hash table. |
| 8 | +--EXTENSIONS-- |
| 9 | +curl |
| 10 | +--FILE-- |
| 11 | +<?php |
| 12 | +require_once __DIR__ . '/../common/http_server.php'; |
| 13 | + |
| 14 | +use function Async\spawn; |
| 15 | +use function Async\await; |
| 16 | + |
| 17 | +$server = async_test_server_start(); |
| 18 | + |
| 19 | +function test_multi_gc_cleanup($port) { |
| 20 | + $mh = curl_multi_init(); |
| 21 | + |
| 22 | + $ch = curl_init(); |
| 23 | + curl_setopt($ch, CURLOPT_URL, "http://localhost:{$port}/"); |
| 24 | + curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); |
| 25 | + curl_multi_add_handle($mh, $ch); |
| 26 | + |
| 27 | + $active = null; |
| 28 | + do { |
| 29 | + $status = curl_multi_exec($mh, $active); |
| 30 | + if ($active > 0) { |
| 31 | + curl_multi_select($mh, 1.0); |
| 32 | + } |
| 33 | + } while ($active > 0); |
| 34 | + |
| 35 | + $result = curl_multi_getcontent($ch); |
| 36 | + echo "Result: $result\n"; |
| 37 | + |
| 38 | + // Do NOT call curl_multi_remove_handle or curl_multi_close. |
| 39 | + // Drop all references so GC destroys the multi handle |
| 40 | + // while libcurl connections are still in the pool. |
| 41 | + unset($ch, $mh); |
| 42 | + |
| 43 | + // Force GC to collect the multi handle |
| 44 | + gc_collect_cycles(); |
| 45 | + |
| 46 | + echo "GC completed without crash\n"; |
| 47 | +} |
| 48 | + |
| 49 | +$coroutine = spawn(fn() => test_multi_gc_cleanup($server->port)); |
| 50 | +await($coroutine); |
| 51 | + |
| 52 | +echo "Done\n"; |
| 53 | + |
| 54 | +async_test_server_stop($server); |
| 55 | +?> |
| 56 | +--EXPECT-- |
| 57 | +Result: Hello World |
| 58 | +GC completed without crash |
| 59 | +Done |
0 commit comments