[streams] Bound user stream wrapper recursion with a depth counter

NEWS

@@ -144,6 +144,8 @@ PHP                                                                        NEWS
 - Streams:
   . Fixed bug GH-15836 (Use-after-free when a user stream filter accesses
     $this->stream during the close flush). (iliaal)
+  . Prevented stack exhaustion through unbounded recursion in user stream
+    wrappers whose nested opens use distinct filenames. (iliaal)
 
 - Sysvshm:
   . Fixed out-of-bounds write when shm_attach() opens an existing segment with

ext/standard/file.h

@@ -98,6 +98,7 @@ typedef struct {
 	char *user_agent; /* for the http wrapper */
 	char *from_address; /* for the ftp and http wrappers */
 	const char *user_stream_current_filename; /* for simple recursion protection */
+	int user_stream_recursion_depth;
 	php_stream_context *default_context;
 	HashTable *stream_wrappers;			/* per-request copy of url_stream_wrappers_hash */
 	HashTable *stream_filters;			/* per-request copy of stream_filters_hash */

ext/standard/tests/streams/user_stream_recursion_unique_names.phpt

@@ -0,0 +1,25 @@
+--TEST--
+User stream wrapper recursion is bounded even when each nested open uses a unique filename
+--FILE--
+<?php
+class RecWrapper
+{
+    public $context;
+    public static $depth = 0;
+    public function stream_open($path, $mode, $options, &$opened_path)
+    {
+        self::$depth++;
+        if (self::$depth >= 100000) {
+            return true;
+        }
+        @fopen('rec://' . self::$depth, 'r');
+        return true;
+    }
+}
+stream_wrapper_register('rec', 'RecWrapper');
+@fopen('rec://start', 'r');
+var_dump(RecWrapper::$depth < 100000);
+echo "OK\n";
+--EXPECT--
+bool(true)
+OK

main/streams/streams.c

@@ -1886,6 +1886,7 @@ static void stream_resource_persistent_dtor(zend_resource *rsrc)
 void php_shutdown_stream_hashes(void)
 {
 	FG(user_stream_current_filename) = NULL;
+	FG(user_stream_recursion_depth) = 0;
 	if (FG(stream_wrappers)) {
 		zend_hash_destroy(FG(stream_wrappers));
 		efree(FG(stream_wrappers));

main/streams/userspace.c

@@ -35,6 +35,8 @@
 
 static int le_protocols;
 
+#define USER_STREAM_MAX_RECURSION_DEPTH 64
+
 struct php_user_stream_wrapper {
 	php_stream_wrapper wrapper;
 	char * protoname;
@@ -302,12 +304,13 @@ static php_stream *user_wrapper_opener(php_stream_wrapper *wrapper, const char *
 	php_stream *stream = NULL;
 	bool old_in_user_include;
 
-	/* Try to catch bad usage without preventing flexibility */
-	if (FG(user_stream_current_filename) != NULL && strcmp(filename, FG(user_stream_current_filename)) == 0) {
+	if ((FG(user_stream_current_filename) != NULL && strcmp(filename, FG(user_stream_current_filename)) == 0)
+		|| FG(user_stream_recursion_depth) >= USER_STREAM_MAX_RECURSION_DEPTH) {
 		php_stream_wrapper_log_error(wrapper, options, "infinite recursion prevented");
 		return NULL;
 	}
 	FG(user_stream_current_filename) = filename;
+	FG(user_stream_recursion_depth)++;
 
 	/* if the user stream was registered as local and we are in include context,
 		we add allow_url_include restrictions to allow_url_fopen ones */
@@ -328,6 +331,7 @@ static php_stream *user_wrapper_opener(php_stream_wrapper *wrapper, const char *
 	user_stream_create_object(uwrap, context, &us->object);
 	if (Z_TYPE(us->object) == IS_UNDEF) {
 		FG(user_stream_current_filename) = NULL;
+		FG(user_stream_recursion_depth)--;
 		PG(in_user_include) = old_in_user_include;
 		efree(us);
 		return NULL;
@@ -379,6 +383,7 @@ static php_stream *user_wrapper_opener(php_stream_wrapper *wrapper, const char *
 	zval_ptr_dtor(&args[0]);
 
 	FG(user_stream_current_filename) = NULL;
+	FG(user_stream_recursion_depth)--;
 
 	PG(in_user_include) = old_in_user_include;
 	return stream;
@@ -402,12 +407,13 @@ static php_stream *user_wrapper_opendir(php_stream_wrapper *wrapper, const char
 	int call_result;
 	php_stream *stream = NULL;
 
-	/* Try to catch bad usage without preventing flexibility */
-	if (FG(user_stream_current_filename) != NULL && strcmp(filename, FG(user_stream_current_filename)) == 0) {
+	if ((FG(user_stream_current_filename) != NULL && strcmp(filename, FG(user_stream_current_filename)) == 0)
+		|| FG(user_stream_recursion_depth) >= USER_STREAM_MAX_RECURSION_DEPTH) {
 		php_stream_wrapper_log_error(wrapper, options, "infinite recursion prevented");
 		return NULL;
 	}
 	FG(user_stream_current_filename) = filename;
+	FG(user_stream_recursion_depth)++;
 
 	us = emalloc(sizeof(*us));
 	us->wrapper = uwrap;
@@ -417,6 +423,7 @@ static php_stream *user_wrapper_opendir(php_stream_wrapper *wrapper, const char
 	user_stream_create_object(uwrap, context, &us->object);
 	if (Z_TYPE(us->object) == IS_UNDEF) {
 		FG(user_stream_current_filename) = NULL;
+		FG(user_stream_recursion_depth)--;
 		efree(us);
 		return NULL;
 	}
@@ -454,6 +461,7 @@ static php_stream *user_wrapper_opendir(php_stream_wrapper *wrapper, const char
 	zval_ptr_dtor(&args[0]);
 
 	FG(user_stream_current_filename) = NULL;
+	FG(user_stream_recursion_depth)--;
 
 	return stream;
 }