Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90820
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.172 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXb0kUT9UstGHn1RTeKkmNQaVXmb6hbhfc-WCPmUMfgJxA@mail.gmail.com>
References: <9D.00.64206.7C430A65@pb1.pair.com> <CAGa2bXb0kUT9UstGHn1RTeKkmNQaVXmb6hbhfc-WCPmUMfgJxA@mail.gmail.com>
Date: Fri, 22 Jan 2016 13:59:13 +0900
Message-ID: <CAGa2bXbXsCKFHSPnw82vkVDmgrd-OQOtahozBdw8qMdN-n3PdQ@mail.gmail.com>
To: Umberto Salsi <salsi@icosaedro.it>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Severe safety fail in file access and stream filters
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi,

On Fri, Jan 22, 2016 at 1:03 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> On Thu, Jan 21, 2016 at 10:30 AM, Umberto Salsi <salsi@icosaedro.it> wrote:
>> I recently discovered several failures in error detection involving
>> file access, stream compression and source inclusion that may bring the
>> program to process missing or invalid data (very severe safety bug) or
>> simply crash without apparent reason. I reported all these issues with
>> their test script trying to do as much as I can to really understand
>> what happen here. I think it's the time for some real internal expert
>> to take over these issues and kindly reply to the following questions:
>>
>> 1. Is there something very basic I'm missing? I'm doing something wrong?
>>
>> 2. If yes, what can I do to fix so that i/o errors can be detected?
>>
>> 3. If no, why i/o errors do not propagate through the engine, but are
>>    mostly ignored? and why the user's program does not get signaled
>>    about this, and keeps receiving empty strings or garbage instead?
>
> Plain file stream reads data by php_stdiop_read()
>
> http://lxr.php.net/xref/PHP_5_6/main/streams/plain_wrapper.c#338
>
> As you can see there is no way to return errors from it. We need
> errno like error handling for PHP streams to propagate errors as well
> as more robust code for unexpected.
>
> So answer for 3 is "we need volunteers" for improvement, I suppose.
> Anyone?

Since I replied, I'll write an implementation idea.

We may add "error" and "clear_error" stream ops in php_stream_ops.

/* operations on streams that are file-handles */
typedef struct _php_stream_ops  {
    /* stdio like functions - these are mandatory! */
    size_t (*write)(php_stream *stream, const char *buf, size_t count
TSRMLS_DC);
    size_t (*read)(php_stream *stream, char *buf, size_t count TSRMLS_DC);
    int    (*close)(php_stream *stream, int close_handle TSRMLS_DC);
    int    (*flush)(php_stream *stream TSRMLS_DC);

    const char *label; /* label for this ops structure */

    /* these are optional */
    int (*seek)(php_stream *stream, off_t offset, int whence, off_t
*newoffset TSRMLS_DC);
    int (*cast)(php_stream *stream, int castas, void **ret TSRMLS_DC);
    int (*stat)(php_stream *stream, php_stream_statbuf *ssb TSRMLS_DC);
    int (*set_option)(php_stream *stream, int option, int value, void
*ptrparam TSRMLS_DC);
} php_stream_ops;

"error" adds whatever errors from stream to an array.
"clear_error" cleanups the array when stream is closed.
There should be an API to get errors in the array.

This is easy change. Difficult part is making codes more robust against
unexpected for all streams.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net