Use zend_list_close instead of zend_list_delete when reconnecting.

michael-grunder · michael-grunder · commit 335c05847c32 · 2017-01-02T17:43:38.000-08:00
In php7 zend_list_close handles closing the connection and frees resource structures but doesn't decrease refcount (and therefore remove the element from the list). This segfault could be triggered in php7 by simply doing this: ```php $r = new Redis(); $r->connect('localhost', 6379); $r->connect('localhost', 6379); $r->ping(); // or any other command ``` What appears to have been happening here, is that phpredis would delete any existing socket resource on a connect call to an already existing object, but then the call to add_property_resource would trigger the destructor of the socket (as the Zend library already saw a "socket" property). This would set redis_sock->stream->abstract (the actual socket) to NULL, causing any subsequent communication to segfault or issue a bus error. Fixes phpredis#1076
diff --git a/redis.c b/redis.c
@@ -799,7 +799,7 @@ PHP_REDIS_API int redis_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent) {
 #if (PHP_MAJOR_VERSION < 7)
             zend_list_delete(Z_LVAL_P(socket));
 #else
-            zend_list_delete(Z_RES_P(socket));
+            zend_list_close(Z_RES_P(socket));
 #endif
         }
     }

Original file line number	Diff line number	Diff line change
`@@ -799,7 +799,7 @@ PHP_REDIS_API int redis_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent) {`
`799`	`799`	`#if (PHP_MAJOR_VERSION < 7)`
`800`	`800`	`zend_list_delete(Z_LVAL_P(socket));`
`801`	`801`	`#else`
`802`		`- zend_list_delete(Z_RES_P(socket));`
	`802`	`+ zend_list_close(Z_RES_P(socket));`
`803`	`803`	`#endif`
`804`	`804`	`}`
`805`	`805`	`}`