Skip to content

Fix fd leak and stale socket issues (security audit) - #11

Merged
pronskiy merged 1 commit into
mainfrom
security-fixes
Mar 23, 2026
Merged

pronskiy merged 1 commit into
mainfrom
security-fixes

Conversation

@pronskiy

Copy link
Copy Markdown
Member

Rebased from closed PR #9.

Fixes file descriptor leaks and stale socket issues identified during security audit.

1. Close socket on remote_init failure (com.c)
   When early connect succeeds but DBGp handshake fails, the socket
   was never closed — causing fd exhaustion under repeated failures.

2. Reset socket fd to -1 after close (com.c)
   xdebug_mark_debug_connection_not_active() closed the socket but
   left the old fd value, risking use-after-close if the fd is reused.

3. Add PHP_DEBUGGER_SESSION_START to RINIT pre-check (xdebug.c)
   The early connect pre-check only tested XDEBUG_SESSION_START env
   var but not the new alias, causing early connect to be skipped
   when using the new trigger name.

@carlos-granados carlos-granados left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, thanks @pronskiy

@pronskiy
pronskiy merged commit 258b227 into main Mar 23, 2026
11 checks passed
@pronskiy
pronskiy deleted the security-fixes branch March 24, 2026 01:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants