From 7139c84f66b51441b9cf8ab0632aae033a079c6d Mon Sep 17 00:00:00 2001 From: Mark Karpeles Date: Fri, 15 Aug 2025 15:01:13 +0900 Subject: [PATCH 1/3] Fix https://github.com/php/php-src/issues/19484 by setting the notice processor to a no-op when a persistent connection is cleaned for future use --- ext/pgsql/pgsql.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c index 11ce814cbec0f..e7a5ee3dbc3f2 100644 --- a/ext/pgsql/pgsql.c +++ b/ext/pgsql/pgsql.c @@ -328,6 +328,10 @@ static void _close_pgsql_plink(zend_resource *rsrc) static void _php_pgsql_notice_handler(void *l, const char *message) { + if (l == NULL) { + /* This connection does not currently have a valid context, ignore this notice */ + return; + } if (PGG(ignore_notices)) { return; } @@ -360,6 +364,9 @@ static int _rollback_transactions(zval *el) link = (PGconn *) rsrc->ptr; + /* unset notice processor */ + PQsetNoticeProcessor(link, _php_pgsql_notice_handler, NULL); + if (PQsetnonblocking(link, 0)) { php_error_docref("ref.pgsql", E_NOTICE, "Cannot set connection to blocking mode"); return -1; From dcbb008b96786114323b474025d14ef4f155eef5 Mon Sep 17 00:00:00 2001 From: Mark Karpeles Date: Fri, 15 Aug 2025 15:14:55 +0900 Subject: [PATCH 2/3] Only set PQsetNoticeProcessor if we did set it to _php_pgsql_notice_handler --- ext/pgsql/pgsql.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c index e7a5ee3dbc3f2..1d7fee6017004 100644 --- a/ext/pgsql/pgsql.c +++ b/ext/pgsql/pgsql.c @@ -364,8 +364,10 @@ static int _rollback_transactions(zval *el) link = (PGconn *) rsrc->ptr; - /* unset notice processor */ - PQsetNoticeProcessor(link, _php_pgsql_notice_handler, NULL); + /* unset notice processor if we initially did set it */ + if (PQsetNoticeProcessor(link, NULL, NULL) == _php_pgsql_notice_handler) { + PQsetNoticeProcessor(link, _php_pgsql_notice_handler, NULL); + } if (PQsetnonblocking(link, 0)) { php_error_docref("ref.pgsql", E_NOTICE, "Cannot set connection to blocking mode"); From 1b8784477c9826f0451c22080ab5f85070a06fc2 Mon Sep 17 00:00:00 2001 From: Mark Karpeles Date: Fri, 15 Aug 2025 15:23:45 +0900 Subject: [PATCH 3/3] Add fixed bug GH-19484 to NEWS --- NEWS | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/NEWS b/NEWS index d23b71bb54af6..371b477eb5940 100644 --- a/NEWS +++ b/NEWS @@ -13,6 +13,10 @@ PHP NEWS - Standard: . Fixed bug GH-16649 (UAF during array_splice). (alexandre-daubois) +- PGSQL: + . Fixed bug GH-19485 (potential use after free when using persistent pgsql + connections). (Mark Karpeles) + 28 Aug 2025, PHP 8.3.25 - Core: