diff --git a/NEWS b/NEWS index d23b71bb54af6..371b477eb5940 100644 --- a/NEWS +++ b/NEWS @@ -13,6 +13,10 @@ PHP NEWS - Standard: . Fixed bug GH-16649 (UAF during array_splice). (alexandre-daubois) +- PGSQL: + . Fixed bug GH-19485 (potential use after free when using persistent pgsql + connections). (Mark Karpeles) + 28 Aug 2025, PHP 8.3.25 - Core: diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c index 11ce814cbec0f..1d7fee6017004 100644 --- a/ext/pgsql/pgsql.c +++ b/ext/pgsql/pgsql.c @@ -328,6 +328,10 @@ static void _close_pgsql_plink(zend_resource *rsrc) static void _php_pgsql_notice_handler(void *l, const char *message) { + if (l == NULL) { + /* This connection does not currently have a valid context, ignore this notice */ + return; + } if (PGG(ignore_notices)) { return; } @@ -360,6 +364,11 @@ static int _rollback_transactions(zval *el) link = (PGconn *) rsrc->ptr; + /* unset notice processor if we initially did set it */ + if (PQsetNoticeProcessor(link, NULL, NULL) == _php_pgsql_notice_handler) { + PQsetNoticeProcessor(link, _php_pgsql_notice_handler, NULL); + } + if (PQsetnonblocking(link, 0)) { php_error_docref("ref.pgsql", E_NOTICE, "Cannot set connection to blocking mode"); return -1;