Repository navigation
Conversation
Member
|
Please rebase after #75 |
mailparse_msg_free() passed any resource to zend_list_close(), so mailparse_msg_free($stream) closed the stream. Fetch the resource as a mailparse message first, as the other mailparse_msg_*() functions do. An already closed resource still returns true.
Extraction calls back into userland (the extract callback, user stream wrappers, output handlers) while it still uses the part. Freeing the part from there with mailparse_msg_free() left extract_part() and MimeMessage::extract_uue() reading the freed part, and extracting the same part again replaced its decoder state and callback context under the outer call. Parsing into the part from there reallocated parsedata.workbuf while a stream write was still reading the decoded data out of it. Mark a part as busy for the duration of extract_part(), extract_uue() and enum_uue(). mailparse_msg_free(), mailparse_msg_parse() and a nested extraction of that part now warn and return false.
iliaal
force-pushed
the
harden-free-during-extract
branch
from
November 6, 2026 13:20
abb0ab7 to
e8d33eb
Compare
Member
Author
|
Rebased |
Member
|
Amended and merged Will see to publish a 3.2.1 soon |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extraction calls back into userland while it still works on the part: the extract callback, a user stream wrapper used as source or destination, and output handlers all run mid-extraction. From there,
mailparse_msg_free()on the part leftextract_part()andMimeMessage::extract_uue()reading freed memory. Extracting the same part again replaced the outer call's decoder state and callback context.mailparse_msg_parse()into the part reallocatedparsedata.workbufwhile a chunked stream write was still reading out of it.A part is now marked busy for the duration of
extract_part(),extract_uue()andenum_uue(); freeing it, parsing into it, or extracting it again now warns and returns false. Freeing an ancestor or extracting a different part from a callback still works. A fatal error raised mid-extraction leaves the flag set, so a shutdown function'smailparse_msg_free()on that part is refused; the resource destructor still frees it.fclose()on the source or destination stream from userland mid-extraction is a stream-layer issue and is not addressed here. This depends on #75 and #77; only the last commit is new here.