mirror of
https://github.com/php/php-src.git
synced 2026-10-29 10:22:06 +08:00
3584a98bda
- Replace bailout on OOM with UnwindExit - Properly reset various globals that may be accessed during startup Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618) Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com> Co-authored-by: Jakub Zelenka <bukka@php.net> Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com> Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
38 lines
1002 B
PHP
38 lines
1002 B
PHP
--TEST--
|
|
OOM raised after a shutdown function does not leak into the next request
|
|
--FILE--
|
|
<?php
|
|
include "php_cli_server.inc";
|
|
php_cli_server_start(<<<'PHP'
|
|
if (isset($_GET['oom'])) {
|
|
register_shutdown_function(function () {
|
|
$a = str_repeat('a', 3 * 1024 * 1024);
|
|
$GLOBALS['b'] = $a . $a;
|
|
});
|
|
return;
|
|
}
|
|
spl_autoload_register(function ($class) {
|
|
eval("class $class {}");
|
|
});
|
|
echo get_class(new Foo), "\n";
|
|
PHP, 'index.php', ['-d', 'memory_limit=8M', '-d', 'html_errors=0']);
|
|
|
|
function send(string $request): string {
|
|
$fp = php_cli_server_connect();
|
|
fwrite($fp, $request);
|
|
$response = stream_get_contents($fp);
|
|
fclose($fp);
|
|
|
|
return $response;
|
|
}
|
|
|
|
$response = send("GET /?oom=1 HTTP/1.1\r\nHost: localhost\r\n\r\n");
|
|
var_dump(str_contains($response, 'Allowed memory size of 8388608 bytes exhausted'));
|
|
|
|
$response = send("GET / HTTP/1.1\r\nHost: localhost\r\n\r\n");
|
|
echo substr($response, strpos($response, "\r\n\r\n") + 4);
|
|
?>
|
|
--EXPECT--
|
|
bool(true)
|
|
Foo
|