[PECL-CVS] [pecl-networking-ssh2] fix/sftp-stream-close-use-after-free: Fixes #81

Author: Rasmus Lerdorf (rlerdorf)
Date: 2026-04-04T06:35:38-04:00

Commit: https://github.com/php/pecl-networking-ssh2/commit/4abc1aece50ca7aec30264a42ee2cf2bd70e75ec
Raw diff: https://github.com/php/pecl-networking-ssh2/commit/4abc1aece50ca7aec30264a42ee2cf2bd70e75ec.diff

Fixes #81

Changed paths:
  M  ssh2_sftp.c


Diff:

diff --git a/ssh2_sftp.c b/ssh2_sftp.c
index 80353b4..f6caa48 100644
--- a/ssh2_sftp.c
+++ b/ssh2_sftp.c
@@ -152,8 +152,11 @@ static ssize_t php_ssh2_sftp_stream_read(php_stream *stream, char *buf, size_t c
 static int php_ssh2_sftp_stream_close(php_stream *stream, int close_handle)
 {
 	php_ssh2_sftp_handle_data *data = (php_ssh2_sftp_handle_data*)stream->abstract;
+	php_ssh2_sftp_data *sftp_data = (php_ssh2_sftp_data*)data->sftp_rsrc->ptr;
 
-	libssh2_sftp_close(data->handle);
+	if (sftp_data && sftp_data->session_rsrc->ptr != NULL) {
+		libssh2_sftp_close(data->handle);
+	}
 	zend_list_delete(data->sftp_rsrc);
 	efree(data);
 
@@ -319,8 +322,11 @@ static ssize_t php_ssh2_sftp_dirstream_read(php_stream *stream, char *buf, size_
 static int php_ssh2_sftp_dirstream_close(php_stream *stream, int close_handle)
 {
 	php_ssh2_sftp_handle_data *data = (php_ssh2_sftp_handle_data*)stream->abstract;
+	php_ssh2_sftp_data *sftp_data = (php_ssh2_sftp_data*)data->sftp_rsrc->ptr;
 
-	libssh2_sftp_close(data->handle);
+	if (sftp_data && sftp_data->session_rsrc->ptr != NULL) {
+		libssh2_sftp_close(data->handle);
+	}
 	zend_list_delete(data->sftp_rsrc);
 	efree(data);