- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Jakub Zelenka <bukka@php.net>
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
When invoking the PHP in a subprocess, TEST_PHP_EXECUTABLE_ESCAPED is
preferable to PHP_BINARY, because the former can be set to ensure that
the just-built (often development) php gets used rather than a system
install. In addition, TEST_PHP_EXTRA_ARGS should be passed to this
interpreter.
Closes GH-22414
php_cli_server_content_sender_send() moved on to the next queued chunk
after a short send() of the current one. When that send() succeeded, its
bytes went out ahead of the current chunk's remainder, and the full-send
branch pointed buffer.first past both, unlinking the partially sent chunk.
The client received later chunks spliced into the body, the connection was
closed short of Content-Length, and the unsent remainder leaked. Stop at
the first partial write and resume from that chunk on the next POLLOUT.
Closes GH-23969
accept() can return a socket without filling in the peer address when the
client has already reset the connection. The address buffer was left
uninitialized and php_network_populate_name_from_sockaddr() does not set the
output string for an unknown family, so zend_string_dup() was handed a NULL.
Zero the buffer and fall back to "-" when the address is unknown.
Close GH-23840
php_cli_server_begin_send_static() opens the file, but for HEAD requests
never stores the descriptor in client->file_fd, so nothing closes it.
Close it right away; Content-Length comes from the stat and the body is
never sent, so the descriptor is not needed.
Closes GH-23765.
sapi_cli_server_send_headers() sent the header buffer through
php_cli_server_client_send_through() but dropped the return value, so it
always reported SAPI_HEADER_SENT_SUCCESSFULLY, even when the send failed
and php_handle_aborted_connection() did not bail out (ignore_user_abort=1).
It now compares the send result against the buffer length and returns
SAPI_HEADER_SEND_FAILED when it comes up short.
php_cli_server_client_send_through() itself returned the number of bytes
left on failure, which equals str_len when nothing was sent: the same
value it returns on success. It now returns the number of bytes actually
sent on both paths.
Since sapi_send_headers() resets headers_sent on SAPI_HEADER_SEND_FAILED,
a headers_written flag on the client guards against rebuilding and
resending the whole header block on every subsequent output write.
Close GH-23428
When installing executables that were built using libtool, we are
supposed to use
$ libtool --mode-install <install-command>
rather than the bare <install-command>. This is discussed ever so
briefly in the "Installing executables" section of the GNU libtool
documentation:
https://www.gnu.org/software/libtool/manual/libtool.html
So far this has not caused a problem with GNU libtool on the platforms
that PHP supports, but there is an alternate libtool implementation
called slibtool that stores wrappers at the locations where PHP is
expecting the true executables to live. As a result, the wrappers (and
not the executables) are installed when slibtool is used to build PHP.
This is fixed by replacing,
$(INSTALL)
with
$(LIBTOOL) --mode=install $(INSTALL)
in the install-foo rules for the executables that are built with
libtool.
Closes GH-13674
This ensures that no useless "Failed to poll event" error messages are
logged during normal server operation, as the SOCK_EAGAIN error simply
indicates another worker is already serving the request.
Closes GH-19964
The ctrl_handler is never destroyed. We have to destroy it at request
end so we avoid leaking it and also avoid keeping a reference to
previous request memory in a next request. The latter can result in a
crash and can be demonstrated with this script and `--repeat 2`:
```php
class Test {
public function set() {
sapi_windows_set_ctrl_handler(self::cb(...));
}
public function cb() {
}
}
$test = new Test;
$test->set();
sleep(3);
```
When you hit CTRL+C in the second request you can crash.
This patch resolves both the leak and crash by destroying the
ctrl_handler after a request.
Closes GH-18231.
Travis was suspended https://github.com/php/php-src/pull/15314
This removes 404 errored Travis image in README, travis configuration
directory and YAML file and usages in tests.
[skip ci]
Co-authored-by: Gina Peter Banyard <girgias@php.net>
* Show build provider information in "php -v"
Vendors such as distributions can set the `PHP_BUILD_PROVIDER`
variable, that gets printed in phpinfo. However, I find that users check
`php -v` more often than phpinfo to see what PHP they're running. The
problem with this is that it does not show that build provider
information.
This change makes the build provider information printed on an
additional line of the version information.
* Put on same line so it works with or without env var
Unbreaks build without PHP_BUILD_PROVIDER set.
* change wording in provider version text
better grammatically; many different possibilities here though
* Unify SAPI version printing
This makes it so that all of the SAPIs share the same code for printing
version information. This is useful in case of any future changes to the
version information, such as i.e. adding build provider to the output.
* Make include for php_print_version explicit
* Preserve phpdbg version and output channel
php_printf doesn't have same semantics, as phpdbg_out could be on a
different output than stdout/err. Also add the phpdbg version (in case
it differs from PHP's, to keep similar output before this PR)
* remove size variables
we don't use them and CI doesn't like unused variables
* Fix format string insecurity
While clang is picky about these, MSVC doesn't seem to care and would
only report the calls to undeclared functions as errors during link
time. Still, obviously, MSVC is fine with having the declarations
during compile time.
This is a follow-up of GH-15177
(c96f08aa70)
and GH-15185
(9467ffb43c)
The PHP_OUTPUT macro was introduced in the very early phase of the build
system due to AC_OUTPUT handling issues in the old Autoconf versions
before the AC_CONFIG_FILES, AC_CONFIG_COMMANDS etc were introduced with
the AC_OUTPUT signature without arguments. The PHP_OUTPUT was also
helping Makefile.in back then being properly generated based on whether
all files were generated or only some (when using the obsolete
CONFIG_FILES=... ./config.status invocation instead of the new
./config.status --file=...). Another issue is that PHP_OUTPUT can't be
used by extensions when using phpize.
This replaces the PHP_OUTPUT invocations with default AC_CONFIG_FILES.
The obsolete "REDO_ALL" feature at the config.status invocation is also
removed with a simpler unconditional generation.
In phar extension the "ext/phar" is replaced with $ext_dir variable to
be able to use phpize.
This macro once had also the 5th argument (the build target), which was
removed via 2a6da0f24c. This quotes all
PHP_SELECT_SAPI arguments and removes the redundant ones. The basic
macro usage help text is moved to the macros section from the obsolete
docs file.
