Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90819
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.181 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <9D.00.64206.7C430A65@pb1.pair.com>
References: <9D.00.64206.7C430A65@pb1.pair.com>
Date: Fri, 22 Jan 2016 13:03:08 +0900
Message-ID: <CAGa2bXb0kUT9UstGHn1RTeKkmNQaVXmb6hbhfc-WCPmUMfgJxA@mail.gmail.com>
To: Umberto Salsi <salsi@icosaedro.it>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Severe safety fail in file access and stream filters
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Umberto,

On Thu, Jan 21, 2016 at 10:30 AM, Umberto Salsi <salsi@icosaedro.it> wrote:
> I recently discovered several failures in error detection involving
> file access, stream compression and source inclusion that may bring the
> program to process missing or invalid data (very severe safety bug) or
> simply crash without apparent reason. I reported all these issues with
> their test script trying to do as much as I can to really understand
> what happen here. I think it's the time for some real internal expert
> to take over these issues and kindly reply to the following questions:
>
> 1. Is there something very basic I'm missing? I'm doing something wrong?
>
> 2. If yes, what can I do to fix so that i/o errors can be detected?
>
> 3. If no, why i/o errors do not propagate through the engine, but are
>    mostly ignored? and why the user's program does not get signaled
>    about this, and keeps receiving empty strings or garbage instead?

Plain file stream reads data by php_stdiop_read()

http://lxr.php.net/xref/PHP_5_6/main/streams/plain_wrapper.c#338

As you can see there is no way to return errors from it. We need
errno like error handling for PHP streams to propagate errors as well
as more robust code for unexpected.

So answer for 3 is "we need volunteers" for improvement, I suppose.
Anyone?

--
Yasuo Ohgaki
yohgaki@ohgaki.net