Ignore calls to close in cURL callbacks.

Jeremy Faller · fredemmott · commit 798604c98fad · 2018-03-02T11:15:26.000-08:00
Summary: Calling curl_close in a callback causes a segmentation fault. This diff ignores call to curl_close when we're in a callback.

Reviewed By: markw65

Differential Revision: D7085062
diff --git a/hphp/runtime/ext/curl/curl-resource.cpp b/hphp/runtime/ext/curl/curl-resource.cpp
@@ -126,6 +126,13 @@ void CurlResource::sweep() {
 }
 
 void CurlResource::close() {
+  // If we try to close while we're in a callback, warn.
+  if (m_in_callback) {
+    raise_warning(
+      "curl_close(): Attempt to close cURL in callback, ignored."
+    );
+    return;
+  }
   closeForSweep();
   m_opts.clear();
   m_to_free.reset();
@@ -1094,6 +1101,10 @@ size_t CurlResource::curl_read(char *data,
         break;
       case PHP_CURL_USER: {
         int data_size = size * nmemb;
+        ch->m_in_callback = true;
+        SCOPE_EXIT {
+          ch->m_in_callback = false;
+        };
         Variant ret = vm_call_user_func(
           t->callback,
           make_packed_array(Resource(ch), Resource(t->fp), data_size));
@@ -1131,6 +1142,10 @@ size_t CurlResource::curl_write(char *data,
         }
         break;
       case PHP_CURL_USER: {
+        ch->m_in_callback = true;
+        SCOPE_EXIT {
+          ch->m_in_callback = false;
+        };
         Variant ret = vm_call_user_func(
           t->callback,
           make_packed_array(Resource(ch), String(data, length, CopyString)));
@@ -1164,6 +1179,10 @@ size_t CurlResource::curl_write_header(char *data,
       case PHP_CURL_FILE:
         return t->fp->write(String(data, length, CopyString), length);
       case PHP_CURL_USER: {
+        ch->m_in_callback = true;
+        SCOPE_EXIT {
+          ch->m_in_callback = false;
+        };
         Variant ret = vm_call_user_func(
           t->callback,
           make_packed_array(Resource(ch), String(data, length, CopyString)));
diff --git a/hphp/runtime/ext/curl/curl-resource.h b/hphp/runtime/ext/curl/curl-resource.h
@@ -137,6 +137,7 @@ struct CurlResource : SweepableResourceData {
   String m_header;
   Array  m_opts;
 
+  bool m_in_callback{false};
   WriteHandler m_write;
   WriteHandler m_write_header;
   ReadHandler  m_read;
diff --git a/hphp/test/slow/ext_curl/curl_close_in_callback.php b/hphp/test/slow/ext_curl/curl_close_in_callback.php
@@ -0,0 +1,6 @@
+<?php
+$handle = curl_init("https://www.facebook.com");
+curl_setopt($handle, CURLOPT_HEADERFUNCTION, function($handle, $header) {
+        curl_close($handle);
+});
+curl_exec($handle);
diff --git a/hphp/test/slow/ext_curl/curl_close_in_callback.php.expectf b/hphp/test/slow/ext_curl/curl_close_in_callback.php.expectf
@@ -0,0 +1 @@
+Warning: curl_close(): Attempt to close cURL in callback, ignored. in %s/curl_close_in_callback.php on line 4
