dba_open() can segfault for "pathless" streams

[YuanchengJiang]

Description

The following code:

<?php
$file = 'data:text/plain;z=y;uri=eviluri;mediatype=wut?;mediatype2=hello,somedata';
$fusion = $file;
$db = dba_open($fusion, 'c', 'inifile');

Resulted in this output:

/php-src/ext/dba/dba.c:845: void php_dba_open(zend_execute_data *, zval *, _Bool): Assertion `opened_path' failed.
Aborted (core dumped)

PHP Version

nightly

Operating System

ubuntu 22.04

[nielsdos]

php-src/ext/dba/dba.c

Lines 845 to 848 in 8953348

	ZEND_ASSERT(opened_path);
	/* replace the path info with the real path of the opened file */
	zend_string_release_ex(connection->info->path, persistent);
	connection->info->path = php_dba_zend_string_dup_safe(opened_path, persistent);

/* replace the path info with the real path of the opened file */

But we don't have a real path...

[cmb69]

Maybe

 ext/dba/dba.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/ext/dba/dba.c b/ext/dba/dba.c
index 04cee6f385..2bd0c8292a 100644
--- a/ext/dba/dba.c
+++ b/ext/dba/dba.c
@@ -842,10 +842,13 @@ static void php_dba_open(INTERNAL_FUNCTION_PARAMETERS, bool persistent)
 			connection->info->lock.fp = php_stream_open_wrapper(lock_name, lock_file_mode, STREAM_MUST_SEEK|REPORT_ERRORS|IGNORE_PATH|persistent_flag, &opened_path);
 			if (connection->info->lock.fp) {
 				if (is_db_lock) {
-					ZEND_ASSERT(opened_path);
-					/* replace the path info with the real path of the opened file */
-					zend_string_release_ex(connection->info->path, persistent);
-					connection->info->path = php_dba_zend_string_dup_safe(opened_path, persistent);
+					if (opened_path) {
+						/* replace the path info with the real path of the opened file */
+						zend_string_release_ex(connection->info->path, persistent);
+						connection->info->path = php_dba_zend_string_dup_safe(opened_path, persistent);
+					} else {
+						zend_argument_error(…);
+					}
 				}
 			}
 			if (opened_path) {

By the way, a couple of lines below we have

php-src/ext/dba/dba.c

Lines 865 to 870 in 3351dae

	if (!php_stream_supports_lock(connection->info->lock.fp)) {
	error = "Stream does not support locking";
	}
	if (php_stream_lock(connection->info->lock.fp, lock_mode)) {
	error = "Unable to establish lock"; /* force failure exit */
	}

It's rather unlikely that the first error message will ever show up.

[nielsdos]

Right, the patch idea makes sense.