{"action":"created","issue":{"url":"https://api.github.com/repos/php/php-src/issues/1051","labels_url":"https://api.github.com/repos/php/php-src/issues/1051/labels{/name}","comments_url":"https://api.github.com/repos/php/php-src/issues/1051/comments","events_url":"https://api.github.com/repos/php/php-src/issues/1051/events","html_url":"https://github.com/php/php-src/pull/1051","id":56626641,"number":1051,"title":"#68986 pointer returned by php_stream_fopen_temporary_file not validated in memory.c","user":{"login":"devzer01","id":4328569,"avatar_url":"https://avatars.githubusercontent.com/u/4328569?v=3","gravatar_id":"","url":"https://api.github.com/users/devzer01","html_url":"https://github.com/devzer01","followers_url":"https://api.github.com/users/devzer01/followers","following_url":"https://api.github.com/users/devzer01/following{/other_user}","gists_url":"https://api.github.com/users/devzer01/gists{/gist_id}","starred_url":"https://api.github.com/users/devzer01/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devzer01/subscriptions","organizations_url":"https://api.github.com/users/devzer01/orgs","repos_url":"https://api.github.com/users/devzer01/repos","events_url":"https://api.github.com/users/devzer01/events{/privacy}","received_events_url":"https://api.github.com/users/devzer01/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-02-05T04:37:42Z","updated_at":"2015-02-05T08:32:37Z","closed_at":"2015-02-05T08:28:46Z","pull_request":{"url":"https://api.github.com/repos/php/php-src/pulls/1051","html_url":"https://github.com/php/php-src/pull/1051","diff_url":"https://github.com/php/php-src/pull/1051.diff","patch_url":"https://github.com/php/php-src/pull/1051.patch"},"body":"it seems that the pointer returned by php_stream_fopen_temporary_file / php_stream_fopen_tmpfile is not validated prior to use in memory.c in the case where a script is executed in an environment  where the TMPDIR is not writable to the user, it will cause a SIGSEGV.\r\n\r\nfrom the script side any code that utilize php://temp with 2MB+ buffer with the above condition will encounter this issue.\r\n\r\ni have fixed the problem on all the calling code in memory.c using php_error_docref, i see that in phar they have handled the condition with zend_throw_exception_ex. i am not in a position to decide which one is best at this time. i think a friendly warning is better than a SIGSEGV at this point :)\r\n\r\ni have validated this problem exists on github-master and releases 5.4.37, 5.4.17 \r\n\r\n```php\r\n#mkdir /tmp/x\r\n#chmod 444 /tmp/x\r\n#export TMPDIR=/tmp/x\r\n\r\n$fp = fopen('php://temp', 'r+');\r\n$data = implode('', array_fill(0, (1024 * 1024 * 2), 'A'));\r\nfwrite($fp, $data);\r\n```"},"comment":{"url":"https://api.github.com/repos/php/php-src/issues/comments/73011246","html_url":"https://github.com/php/php-src/pull/1051#issuecomment-73011246","issue_url":"https://api.github.com/repos/php/php-src/issues/1051","id":73011246,"user":{"login":"devzer01","id":4328569,"avatar_url":"https://avatars.githubusercontent.com/u/4328569?v=3","gravatar_id":"","url":"https://api.github.com/users/devzer01","html_url":"https://github.com/devzer01","followers_url":"https://api.github.com/users/devzer01/followers","following_url":"https://api.github.com/users/devzer01/following{/other_user}","gists_url":"https://api.github.com/users/devzer01/gists{/gist_id}","starred_url":"https://api.github.com/users/devzer01/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devzer01/subscriptions","organizations_url":"https://api.github.com/users/devzer01/orgs","repos_url":"https://api.github.com/users/devzer01/repos","events_url":"https://api.github.com/users/devzer01/events{/privacy}","received_events_url":"https://api.github.com/users/devzer01/received_events","type":"User","site_admin":false},"created_at":"2015-02-05T08:32:37Z","updated_at":"2015-02-05T08:32:37Z","body":"thanks :) "}}