fix: potential crash when using apache_request_headers()

.github/workflows/docker.yaml

@@ -19,6 +19,7 @@ on:
     - cron:  '0 4 * * *'
 env:
   IMAGE_NAME: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.version) || startsWith(github.ref, 'refs/tags/')) && 'dunglas/frankenphp' || 'dunglas/frankenphp-dev' }}
+  LATEST: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.version) || startsWith(github.ref, 'refs/tags/')) && '0' || '1' }}
 jobs:
   prepare:
     runs-on: ubuntu-latest
@@ -37,6 +38,8 @@ jobs:
       -
         name: Check PHP versions
         id: check
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           PHP_82_LATEST=$(skopeo inspect docker://docker.io/library/php:8.2 --override-os linux --override-arch amd64 | jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")')
           PHP_83_LATEST=$(skopeo inspect docker://docker.io/library/php:8.3 --override-os linux --override-arch amd64 | jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")')
@@ -45,13 +48,13 @@ jobs:
             echo php82_version="${PHP_82_LATEST//./-}"
             echo php83_version="${PHP_83_LATEST//./-}"
           } >> "${GITHUB_OUTPUT}"
- 
+
           # Check if the Docker images must be rebuilt
           if [[ "${GITHUB_EVENT_NAME}" != "schedule"  ]]; then
               echo skip=false >> "${GITHUB_OUTPUT}"
               exit 0
           fi
- 
+
           FRANKENPHP_82_LATEST=$(skopeo inspect docker://docker.io/dunglas/frankenphp:latest-php8.2 --override-os linux --override-arch amd64 | jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")')
           FRANKENPHP_83_LATEST=$(skopeo inspect docker://docker.io/dunglas/frankenphp:latest-php8.3 --override-os linux --override-arch amd64 | jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")')
 
@@ -59,7 +62,7 @@ jobs:
               echo skip=true >> "${GITHUB_OUTPUT}"
               exit 0
           fi
- 
+
           {
             echo ref="$(gh release view --repo dunglas/frankenphp --json tagName --jq '.tagName')"
             echo skip=false
@@ -89,7 +92,6 @@ jobs:
           SHA: ${{ github.sha }}
           VERSION: ${{ (github.ref_type == 'tag' && github.ref_name) || steps.check.outputs.ref || github.sha }}
           PHP_VERSION: ${{ steps.check.outputs.php_version }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build:
     runs-on: ubuntu-latest
     needs:
@@ -229,7 +231,8 @@ jobs:
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          version: latest
+          # Temporary fix for https://github.com/docker/buildx/issues/2229
+          version: "https://github.com/jedevc/buildx.git#imagetools-resolver-copy-dupe"
       -
         name: Login to DockerHub
         uses: docker/login-action@v3
@@ -240,6 +243,7 @@ jobs:
         name: Create manifest list and push
         working-directory: /tmp/metadata
         run: |
+          set -x
           # shellcheck disable=SC2046,SC2086
           docker buildx imagetools create $(jq -cr '.target."${{ matrix.target }}-${{ matrix.variant }}".tags | map("-t " + .) | join(" ")' <<< ${METADATA}) \
             $(printf 'dunglas/frankenphp@sha256:%s ' *)

.github/workflows/static.yaml

@@ -19,6 +19,7 @@ on:
     - cron:  '0 0 * * *'
 env:
   IMAGE_NAME: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.version) || startsWith(github.ref, 'refs/tags/')) && 'dunglas/frankenphp' || 'dunglas/frankenphp-dev' }}    
+  LATEST: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.version) || startsWith(github.ref, 'refs/tags/')) && '0' || '1' }}
 jobs:
   prepare:
     runs-on: ubuntu-latest

docs/docker.md

@@ -144,3 +144,18 @@ RUN adduser -D ${USER} \
 	# Caddy requires write access to /data/caddy and /config/caddy
 	RUN chown -R ${USER}:${USER} /data/caddy && chown -R ${USER}:${USER} /config/caddy
 ```
+
+## Updates
+
+The Docker images are built:
+
+* when a new release is tagged
+* daily at 4am UTC, if new versions of the official PHP images are available
+
+## Development Versions
+
+Development versions are available in the [`dunglas/frankenphp-dev`](https://hub.docker.com/repository/docker/dunglas/frankenphp-dev) Docker repository.
+A new build is triggered every time a commit is pushed to the main branch of the GitHub repository.
+
+The `latest*` tags point to the head of the `main` branch.
+Tags of the form `sha-<git-commit-hash>` are also available.

frankenphp.c

@@ -262,6 +262,7 @@ PHP_FUNCTION(frankenphp_request_headers) {
   }
 
   free(headers.r0);
+  go_apache_request_cleanup(headers.r2);
 }
 /* }}} */
 

frankenphp.go

@@ -582,24 +582,41 @@ func go_register_variables(rh C.uintptr_t, trackVarsArray *C.zval) {
 }
 
 //export go_apache_request_headers
-func go_apache_request_headers(rh C.uintptr_t) (*C.go_string, C.size_t) {
+func go_apache_request_headers(rh C.uintptr_t) (*C.go_string, C.size_t, C.uintptr_t) {
 	r := cgo.Handle(rh).Value().(*http.Request)
 
+	pinner := runtime.Pinner{}
+	pinnerHandle := C.uintptr_t(cgo.NewHandle(pinner))
+
 	rl := len(r.Header)
 	scs := unsafe.Sizeof(C.go_string{})
 
 	headers := (*C.go_string)(unsafe.Pointer(C.malloc(C.size_t(rl*2) * (C.size_t)(scs))))
 	header := headers
 	for field, val := range r.Header {
-		*header = C.go_string{C.size_t(len(field)), (*C.char)(unsafe.Pointer(unsafe.StringData(field)))}
+		fd := unsafe.StringData(field)
+		pinner.Pin(fd)
+
+		*header = C.go_string{C.size_t(len(field)), (*C.char)(unsafe.Pointer(fd))}
 		header = (*C.go_string)(unsafe.Add(unsafe.Pointer(header), scs))
 
 		cv := strings.Join(val, ", ")
-		*header = C.go_string{C.size_t(len(cv)), (*C.char)(unsafe.Pointer(unsafe.StringData(cv)))}
+		vd := unsafe.StringData(cv)
+		pinner.Pin(vd)
+
+		*header = C.go_string{C.size_t(len(cv)), (*C.char)(unsafe.Pointer(vd))}
 		header = (*C.go_string)(unsafe.Add(unsafe.Pointer(header), scs))
 	}
 
-	return headers, C.size_t(rl)
+	return headers, C.size_t(rl), pinnerHandle
+}
+
+//export go_apache_request_cleanup
+func go_apache_request_cleanup(rh C.uintptr_t) {
+	h := cgo.Handle(rh)
+	p := h.Value().(runtime.Pinner)
+	p.Unpin()
+	h.Delete()
 }
 
 func addHeader(fc *FrankenPHPContext, cString *C.char, length C.int) {

frankenphp_test.go

@@ -581,8 +581,8 @@ func TestRequestHeaders_worker(t *testing.T) {
 func testRequestHeaders(t *testing.T, opts *testOptions) {
 	runTest(t, func(handler func(http.ResponseWriter, *http.Request), _ *httptest.Server, i int) {
 		req := httptest.NewRequest("GET", fmt.Sprintf("http://example.com/request-headers.php?i=%d", i), nil)
-		req.Header.Add("Content-Type", "text/plain")
-		req.Header.Add("Frankenphp-I", strconv.Itoa(i))
+		req.Header.Add(strings.Clone("Content-Type"), strings.Clone("text/plain"))
+		req.Header.Add(strings.Clone("Frankenphp-I"), strings.Clone(strconv.Itoa(i)))
 
 		w := httptest.NewRecorder()
 		handler(w, req)