Skip to content

Fix PSR-18 client memory management & harden UploadedFile::moveTo() security #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yordadev merged 1 commit into from
Jan 16, 2026
Merged

Fix PSR-18 client memory management & harden UploadedFile::moveTo() security #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Signalforge/Http/Request.stub.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,9 +167,9 @@ public function withMethod(string $method): static {}
/**
* Retrieves the URI instance.
*
* @return string URI as string (basic implementation)
* @return \Psr\Http\Message\UriInterface URI instance
*/
public function getUri(): string {}
public function getUri(): \Psr\Http\Message\UriInterface {}

/**
* Returns an instance with the provided URI.
Expand Down
48 changes: 26 additions & 22 deletions src/client/client.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,18 +119,18 @@ static void signalforge_client_free_object(zend_object *object) {

if (client->config) {
if (client->config->proxy) {
free(client->config->proxy);
efree(client->config->proxy);
}
if (client->config->user_agent) {
free(client->config->user_agent);
efree(client->config->user_agent);
}
if (client->config->ca_cert) {
free(client->config->ca_cert);
efree(client->config->ca_cert);
}
if (client->config->retry_config) {
signalforge_client_retry_config_destroy(client->config->retry_config);
}
free(client->config);
efree(client->config);
client->config = NULL;
}

Expand Down Expand Up @@ -196,13 +196,13 @@ static char *extract_method(zval *request_obj) {
zend_call_method_with_0_params(Z_OBJ_P(request_obj), Z_OBJCE_P(request_obj), NULL, "getmethod", &method_result);

if (Z_TYPE(method_result) == IS_STRING && Z_STRLEN(method_result) > 0) {
char *method = strdup(Z_STRVAL(method_result));
char *method = estrdup(Z_STRVAL(method_result));
zval_ptr_dtor(&method_result);
return method;
}

zval_ptr_dtor(&method_result);
return strdup("GET");
return estrdup("GET");
}

static char *extract_uri(zval *request_obj) {
Expand All @@ -215,20 +215,20 @@ static char *extract_uri(zval *request_obj) {
zend_call_method_with_0_params(Z_OBJ(uri_result), Z_OBJCE(uri_result), NULL, "__tostring", &str_result);

if (Z_TYPE(str_result) == IS_STRING && Z_STRLEN(str_result) > 0) {
char *uri = strdup(Z_STRVAL(str_result));
char *uri = estrdup(Z_STRVAL(str_result));
zval_ptr_dtor(&str_result);
zval_ptr_dtor(&uri_result);
return uri;
}
zval_ptr_dtor(&str_result);
} else if (Z_TYPE(uri_result) == IS_STRING && Z_STRLEN(uri_result) > 0) {
char *uri = strdup(Z_STRVAL(uri_result));
char *uri = estrdup(Z_STRVAL(uri_result));
zval_ptr_dtor(&uri_result);
return uri;
}

zval_ptr_dtor(&uri_result);
return strdup("http://localhost/");
return estrdup("http://localhost/");
}

static void extract_headers(zval *request_obj, zval *headers_array) {
Expand Down Expand Up @@ -256,15 +256,15 @@ static void extract_body(zval *request_obj, char **body, size_t *body_len) {
zend_string *str = zval_get_string(&body_result);

if (str && ZSTR_LEN(str) > 0) {
*body = malloc(ZSTR_LEN(str));
*body = emalloc(ZSTR_LEN(str));
if (*body) {
memcpy(*body, ZSTR_VAL(str), ZSTR_LEN(str));
*body_len = ZSTR_LEN(str);
}
}
zend_string_release(str);
} else if (Z_TYPE(body_result) == IS_STRING && Z_STRLEN(body_result) > 0) {
*body = malloc(Z_STRLEN(body_result));
*body = emalloc(Z_STRLEN(body_result));
if (*body) {
memcpy(*body, Z_STRVAL(body_result), Z_STRLEN(body_result));
*body_len = Z_STRLEN(body_result);
Expand Down Expand Up @@ -301,9 +301,11 @@ static signalforge_client_request_t *signalforge_client_psr7_extract_request(
config
);

free(method);
free(url);
free(body);
efree(method);
efree(url);
if (body) {
efree(body);
}
zval_ptr_dtor(&headers);

return request;
Expand All @@ -323,7 +325,7 @@ static PHP_METHOD(SignalforgeClient, __construct) {

client_obj = SIGNALFORGE_CLIENT_FROM_ZOBJ(Z_OBJ_P(ZEND_THIS));

config = calloc(1, sizeof(signalforge_client_config_t));
config = ecalloc(1, sizeof(signalforge_client_config_t));
if (!config) {
zend_throw_exception(signalforge_http_exception_ce, "Failed to allocate memory for configuration", 0);
RETURN_THROWS();
Expand Down Expand Up @@ -380,13 +382,13 @@ static PHP_METHOD(SignalforgeClient, __construct) {

if ((val = zend_hash_str_find(Z_ARRVAL_P(options), "proxy", sizeof("proxy") - 1)) != NULL) {
zend_string *proxy_str = zval_get_string(val);
config->proxy = strdup(ZSTR_VAL(proxy_str));
config->proxy = estrdup(ZSTR_VAL(proxy_str));
zend_string_release(proxy_str);
}

if ((val = zend_hash_str_find(Z_ARRVAL_P(options), "user_agent", sizeof("user_agent") - 1)) != NULL) {
zend_string *ua_str = zval_get_string(val);
config->user_agent = strdup(ZSTR_VAL(ua_str));
config->user_agent = estrdup(ZSTR_VAL(ua_str));
zend_string_release(ua_str);
}

Expand All @@ -400,7 +402,7 @@ static PHP_METHOD(SignalforgeClient, __construct) {

if ((val = zend_hash_str_find(Z_ARRVAL_P(options), "ca_cert", sizeof("ca_cert") - 1)) != NULL) {
zend_string *ca_str = zval_get_string(val);
config->ca_cert = strdup(ZSTR_VAL(ca_str));
config->ca_cert = estrdup(ZSTR_VAL(ca_str));
zend_string_release(ca_str);
}

Expand Down Expand Up @@ -456,7 +458,7 @@ static PHP_METHOD(SignalforgeClient, __construct) {
/* Create shared connection cache */
client_obj->share = signalforge_client_share_create();
if (!client_obj->share) {
free(config);
efree(config);
client_obj->config = NULL;
zend_throw_exception(signalforge_http_exception_ce, "Failed to create shared connection cache", 0);
RETURN_THROWS();
Expand All @@ -470,7 +472,7 @@ static PHP_METHOD(SignalforgeClient, __construct) {
if (!client_obj->thread_pool) {
signalforge_client_share_destroy(client_obj->share);
client_obj->share = NULL;
free(config);
efree(config);
client_obj->config = NULL;
zend_throw_exception(signalforge_http_exception_ce, "Failed to create thread pool", 0);
RETURN_THROWS();
Expand Down Expand Up @@ -534,7 +536,7 @@ static PHP_METHOD(SignalforgeClient, sendRequest) {
char *msg_copy = NULL;

if (response->error_message) {
msg_copy = strdup(response->error_message);
msg_copy = estrdup(response->error_message);
}

signalforge_client_response_destroy(response);
Expand All @@ -555,7 +557,9 @@ static PHP_METHOD(SignalforgeClient, sendRequest) {

zend_throw_exception(signalforge_network_exception_ce, detailed_msg, (zend_long)curl_code);

free(msg_copy);
if (msg_copy) {
efree(msg_copy);
}
RETURN_THROWS();
}

Expand Down
38 changes: 21 additions & 17 deletions src/client/curl_easy.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ static size_t write_callback(void *ptr, size_t size, size_t nmemb, void *userdat
new_capacity = ctx->response_body_len + total_size + 4096;
}

char *new_body = realloc(ctx->response_body, new_capacity);
char *new_body = erealloc(ctx->response_body, new_capacity);
if (!new_body) {
return 0;
}
Expand All @@ -85,7 +85,7 @@ static size_t header_callback(void *ptr, size_t size, size_t nmemb, void *userda
new_capacity = ctx->response_headers_len + total_size + 1024;
}

char *new_headers = realloc(ctx->response_headers, new_capacity);
char *new_headers = erealloc(ctx->response_headers, new_capacity);
if (!new_headers) {
return 0;
}
Expand Down Expand Up @@ -125,7 +125,7 @@ void signalforge_curl_parse_headers(signalforge_curl_context_t *ctx) {
return;
}

ctx->response->headers = malloc(sizeof(signalforge_client_header_t) * header_count);
ctx->response->headers = emalloc(sizeof(signalforge_client_header_t) * header_count);
if (!ctx->response->headers) {
return;
}
Expand All @@ -140,7 +140,7 @@ void signalforge_curl_parse_headers(signalforge_curl_context_t *ctx) {
char *colon = memchr(ptr, ':', line_end - ptr);
if (colon) {
size_t name_len = colon - ptr;
char *name = malloc(name_len + 1);
char *name = emalloc(name_len + 1);
if (name) {
memcpy(name, ptr, name_len);
name[name_len] = '\0';
Expand All @@ -159,7 +159,7 @@ void signalforge_curl_parse_headers(signalforge_curl_context_t *ctx) {
value_len--;
}

char *value = malloc(value_len + 1);
char *value = emalloc(value_len + 1);
if (value) {
memcpy(value, value_start, value_len);
value[value_len] = '\0';
Expand All @@ -168,7 +168,7 @@ void signalforge_curl_parse_headers(signalforge_curl_context_t *ctx) {
ctx->response->headers[idx].value = value;
idx++;
} else {
free(name);
efree(name);
}
}
}
Expand Down Expand Up @@ -285,13 +285,13 @@ int signalforge_curl_setup(
for (size_t i = 0; i < ctx->request->header_count; i++) {
size_t header_len = strlen(ctx->request->headers[i].name) +
strlen(ctx->request->headers[i].value) + 3;
char *header = malloc(header_len);
char *header = emalloc(header_len);
if (header) {
snprintf(header, header_len, "%s: %s",
ctx->request->headers[i].name,
ctx->request->headers[i].value);
list = curl_slist_append(list, header);
free(header);
efree(header);
}
}
if (list) {
Expand Down Expand Up @@ -364,13 +364,17 @@ void signalforge_curl_cleanup_context(signalforge_curl_context_t *ctx) {
ctx->header_list = NULL;
}

free(ctx->response_body);
ctx->response_body = NULL;
if (ctx->response_body) {
efree(ctx->response_body);
ctx->response_body = NULL;
}
ctx->response_body_len = 0;
ctx->response_body_capacity = 0;

free(ctx->response_headers);
ctx->response_headers = NULL;
if (ctx->response_headers) {
efree(ctx->response_headers);
ctx->response_headers = NULL;
}
ctx->response_headers_len = 0;
ctx->response_headers_capacity = 0;

Expand Down Expand Up @@ -421,13 +425,13 @@ signalforge_client_response_t *signalforge_curl_easy_execute(

/* Allocate response buffers */
ctx.response_body_capacity = 4096;
ctx.response_body = malloc(ctx.response_body_capacity);
ctx.response_body = emalloc(ctx.response_body_capacity);
ctx.response_headers_capacity = 1024;
ctx.response_headers = malloc(ctx.response_headers_capacity);
ctx.response_headers = emalloc(ctx.response_headers_capacity);

if (!ctx.response_body || !ctx.response_headers) {
free(ctx.response_body);
free(ctx.response_headers);
if (ctx.response_body) efree(ctx.response_body);
if (ctx.response_headers) efree(ctx.response_headers);
signalforge_client_response_destroy(response);
curl_easy_cleanup(curl);
return NULL;
Expand Down Expand Up @@ -500,7 +504,7 @@ signalforge_client_response_t *signalforge_curl_easy_execute(
retry_count++;
} else {
/* No retry - set error message */
response->error_message = strdup(curl_easy_strerror(result));
response->error_message = estrdup(curl_easy_strerror(result));
break;
}

Expand Down
Loading