[php-src] Issue #21068: finfo_open with directory cause invalid free

[email protected] (ArchMaster2024)
Newsgroups php.bugs
Message-ID <vmUlyFJP8uG8EOZ2jeTvvoMqILyvbmFxkCyPaOeOHto@main.internal.php.net>
Issue: https://github.com/php/php-src/issues/21068
Author: ArchMaster2024

### Description

The following code:

```php

$magic_file = __DIR__ . DIRECTORY_SEPARATOR . 'magic私はガラスを食べられます';

$ret = @finfo_open(FILEINFO_NONE, $magic_file . ".non-exits私はガラスを食べられます");
var_dump($ret);

$dir = __DIR__ . "/bug61964-mb";
@mkdir($dir);

$magic_file_copy = $dir . "/magic私はガラスを食べられます.copy";
$magic_file_copy2 = $magic_file_copy . "2";
copy($magic_file, $magic_file_copy);
copy($magic_file, $magic_file_copy2);

$ret = finfo_open(FILEINFO_NONE, $dir);
var_dump($ret);

$ret = @finfo_open(FILEINFO_NONE, $dir);
var_dump($ret);

$ret = @finfo_open(FILEINFO_NONE, $dir. "/non-exits-dir私はガラスを食べられます");
var_dump($ret);

// write some test files to test folder
file_put_contents($dir . "/test1.txt", "string\n> Core\n> Me");
file_put_contents($dir . "/test2.txt", "a\nb\n");
@mkdir($dir . "/test-inner-folder私はガラスを食べられます");

finfo_open(FILEINFO_NONE, $dir);
echo "DONE: testing dir with files\n";

rmdir($dir . "/test-inner-folder私はガラスを食べられます");
unlink($dir . "/test1.txt");
unlink($dir . "/test2.txt");

unlink($magic_file_copy);
unlink($magic_file_copy2);
rmdir($dir);
<?php
```

Resulted in this output:
```
bool(false)

Warning: copy(/test_php/source/php/ext/fileinfo/tests/magic私はガラスを食べられます): Failed to open stream: No such file or directory in /test_php/source/php/ext/fileinfo/tests/bug61964-mb.php on line 13

Warning: copy(/test_php/source/php/ext/fileinfo/tests/magic私はガラスを食べられます): Failed to open stream: No such file or directory in /test_php/source/php/ext/fileinfo/tests/bug61964-mb.php on line 14
object(finfo)#1 (0) {
}
object(finfo)#2 (0) {
}
bool(false)

Notice: finfo_open(): Read of 8192 bytes failed with errno=21 Is a directory in /test_php/source/php/ext/fileinfo/tests/bug61964-mb.php on line 30

Warning: finfo_open(): offset `string' invalid in /test_php/source/php/ext/fileinfo/tests/bug61964-mb.php on line 30

Warning: finfo_open(): offset ` Core' invalid in /test_php/source/php/ext/fileinfo/tests/bug61964-mb.php on line 30

Warning: finfo_open(): offset ` Me' invalid in /test_php/source/php/ext/fileinfo/tests/bug61964-mb.php on line 30

Warning: finfo_open(): offset `a' invalid in /test_php/source/php/ext/fileinfo/tests/bug61964-mb.php on line 30

Warning: finfo_open(): offset `b' invalid in /test_php/source/php/ext/fileinfo/tests/bug61964-mb.php on line 30

Warning: finfo_open(): Failed to load magic database at "/test_php/source/php/ext/fileinfo/tests/bug61964-mb" in /test_php/source/php/ext/fileinfo/tests/bug61964-mb.php on line 30
DONE: testing dir with files

Warning: unlink(/test_php/source/php/ext/fileinfo/tests/bug61964-mb/magic私はガラスを食べられます.copy): No such file or directory in /test_php/source/php/ext/fileinfo/tests/bug61964-mb.php on line 37

Warning: unlink(/test_php/source/php/ext/fileinfo/tests/bug61964-mb/magic私はガラスを食べられます.copy2): No such file or directory in /test_php/source/php/ext/fileinfo/tests/bug61964-mb.php on line 38
```

But I expected this output instead:
```
bool(false)%A
object(finfo)#%d (0) {
}
object(finfo)#%d (0) {
}
bool(false)%A
Warning: finfo_open(): offset `string' invalid in %sbug61964-mb.php on line %d

Warning: finfo_open(): offset ` Core' invalid in %sbug61964-mb.php on line %d

Warning: finfo_open(): offset ` Me' invalid in %sbug61964-mb.php on line %d

Warning: finfo_open(): offset `a' invalid in %sbug61964-mb.php on line %d

Warning: finfo_open(): offset `b' invalid in %sbug61964-mb.php on line %d

Warning: finfo_open(): Failed to load magic database at "%sbug61964-mb" in %sbug61964-mb.php on line %d
DONE: testing dir with files
```


### PHP Version

```plain
PHP 8.4.17RC1 (cli) (built: Jan 25 2026 21:18:17) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.4.17RC1, Copyright (c) Zend Technologies
```

### Operating System

Debian GNU/Linux 12 (bookworm) x86_64 (container run with podman)
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.