[php-src] Issue #19520: `php_admin_value[extension]=` in FPM pool configuration unsafely runs RINIT

Issue: https://github.com/php/php-src/issues/19520 Author: TimWolla ### Description With the following configuration: ```php [global] log_level = debug error_log = /dev/stderr [www] listen = 9999 pm = ondemand pm.max_children = 3 php_admin_value[extension]=session.so catch_workers_output=true ``` and a small patch to session.c to enable session auto start by default (custom INI flags are not loaded in time, other in-tree extensions do not crash): ``` diff --git i/ext/session/session.c w/ext/session/session.c index 70e1673d87f..fd6c6cef77d 100644 --- i/ext/session/session.c +++ w/ext/session/session.c @@ -900,7 +900,7 @@ PHP_INI_BEGIN() STD_PHP_INI_ENTRY("session.save_path", "", PHP_INI_ALL, OnUpdateSaveDir, save_path, php_ps_globals, ps_globals) STD_PHP_INI_ENTRY("session.name", "PHPSESSID", PHP_INI_ALL, OnUpdateName, session_name, php_ps_globals, ps_globals) PHP_INI_ENTRY("session.save_handler", "files", PHP_INI_ALL, OnUpdateSaveHandler) - STD_PHP_INI_BOOLEAN("session.auto_start", "0", PHP_INI_PERDIR, OnUpdateBool, auto_start, php_ps_globals, ps_globals) + STD_PHP_INI_BOOLEAN("session.auto_start", "1", PHP_INI_PERDIR, OnUpdateBool, auto_start, php_ps_globals, ps_globals) STD_PHP_INI_ENTRY("session.gc_probability", "1", PHP_INI_ALL, OnUpdateSessionGcProbability, gc_probability, php_ps_globals, ps_globals) STD_PHP_INI_ENTRY("session.gc_divisor", "100", PHP_INI_ALL, OnUpdateSessionDivisor,gc_divisor, php_ps_globals, ps_globals) STD_PHP_INI_ENTRY("session.gc_maxlifetime", "1440", PHP_INI_ALL, OnUpdateSessionLong, gc_maxlifetime, php_ps_globals, ps_globals) ``` and then running: ``` sapi/fpm/php-fpm -y fpm.conf -F ``` and sending a request results in this output: ``` [19-Aug-2025 12:48:16.712084] DEBUG: pid 700863, fpm_pctl_on_socket_accept(), line 553: [pool www] got accept without idle child available .... I forked [19-Aug-2025 12:48:16.712117] DEBUG: pid 700863, fpm_event_loop(), line 426: event module triggered 1 events [19-Aug-2025 12:48:16.715649] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "php-src/Zend/zend_hash.c:783:8: runtime error: applying non-zero offset 3667908216 to null pointer" [19-Aug-2025 12:48:16.715734] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior php-src/Zend/zend_hash.c:783:8 in " [19-Aug-2025 12:48:16.715807] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "AddressSanitizer:DEADLYSIGNAL" [19-Aug-2025 12:48:16.715850] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "=================================================================" [19-Aug-2025 12:48:16.715884] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "==700924==ERROR: AddressSanitizer: SEGV on unknown address 0x00009b537acf (pc 0x591d64517a26 bp 0x7ffd030695a0 sp 0x7ffd03069480 T0)" [19-Aug-2025 12:48:16.715929] DEBUG: pid 700863, fpm_event_loop(), line 426: event module triggered 1 events [19-Aug-2025 12:48:16.715997] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "==700924==The signal is caused by a READ memory access." [19-Aug-2025 12:48:16.716042] DEBUG: pid 700863, fpm_event_loop(), line 426: event module triggered 1 events [19-Aug-2025 12:48:16.966689] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #0 0x591d64517a26 in zend_hash_str_find_bucket php-src/Zend/zend_hash.c:783:8" [19-Aug-2025 12:48:16.966738] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #1 0x591d6451776e in zend_hash_str_find php-src/Zend/zend_hash.c:2697:6" [19-Aug-2025 12:48:16.966753] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #2 0x74debef243e8 in php_session_start php-src/ext/session/session.c:1669:34" [19-Aug-2025 12:48:16.966771] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #3 0x74debef60478 in php_rinit_session php-src/ext/session/session.c:2906:3" [19-Aug-2025 12:48:16.966784] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #4 0x74debef4b0de in zm_activate_session php-src/ext/session/session.c:2914:9" [19-Aug-2025 12:48:16.966804] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #5 0x591d62ee3f62 in php_load_extension php-src/ext/standard/dl.c:247:7" [19-Aug-2025 12:48:16.966820] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #6 0x591d62ee2294 in php_dl php-src/ext/standard/dl.c:284:6" [19-Aug-2025 12:48:16.966838] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #7 0x591d64939582 in fpm_php_apply_defines_ex php-src/sapi/fpm/fpm/fpm_php.c:105:3" [19-Aug-2025 12:48:16.966851] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #8 0x591d6493ae66 in fpm_php_apply_defines php-src/sapi/fpm/fpm/fpm_php.c:151:18" [19-Aug-2025 12:48:16.966871] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #9 0x591d6493a7c4 in fpm_php_init_child php-src/sapi/fpm/fpm/fpm_php.c:246:10" [19-Aug-2025 12:48:16.966886] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #10 0x591d648da060 in fpm_child_init php-src/sapi/fpm/fpm/fpm_children.c:199:10" [19-Aug-2025 12:48:16.966906] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #11 0x591d648d8fa0 in fpm_children_make php-src/sapi/fpm/fpm/fpm_children.c:461:5" [19-Aug-2025 12:48:16.966922] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #12 0x591d64946be4 in fpm_pctl_on_socket_accept php-src/sapi/fpm/fpm/fpm_process_ctl.c:547:2" [19-Aug-2025 12:48:16.966939] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #13 0x591d64918192 in fpm_event_fire php-src/sapi/fpm/fpm/fpm_events.c:478:2" [19-Aug-2025 12:48:16.966953] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #14 0x591d6498fc67 in fpm_event_epoll_wait php-src/sapi/fpm/fpm/events/epoll.c:141:3" [19-Aug-2025 12:48:16.966973] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #15 0x591d6491447a in fpm_event_loop php-src/sapi/fpm/fpm/fpm_events.c:418:9" [19-Aug-2025 12:48:16.966988] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #16 0x591d648d4c33 in fpm_run php-src/sapi/fpm/fpm/fpm.c:113:2" [19-Aug-2025 12:48:16.967005] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #17 0x591d64923f22 in main php-src/sapi/fpm/fpm/fpm_main.c:1845:12" [19-Aug-2025 12:48:16.967018] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #18 0x74dec122a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16" [19-Aug-2025 12:48:16.967036] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #19 0x74dec122a28a in __libc_start_main csu/../csu/libc-start.c:360:3" [19-Aug-2025 12:48:16.967052] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #20 0x591d61603434 in _start (php-src/sapi/fpm/php-fpm+0x1c03434) (BuildId: 7efba1981fd9239610ec7542417a9d447b071b1b)" [19-Aug-2025 12:48:16.967070] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "AddressSanitizer can not provide additional info." [19-Aug-2025 12:48:16.967087] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "SUMMARY: AddressSanitizer: SEGV php-src/Zend/zend_hash.c:783:8 in zend_hash_str_find_bucket" [19-Aug-2025 12:48:16.967106] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "==700924==ABORTING" ``` But I expected this output instead: No crash. ### PHP Version ```plain PHP 8.4.13-dev (fpm-fcgi) (built: Aug 19 2025 12:40:44) (NTS DEBUG) Copyright (c) The PHP Group Zend Engine v4.4.13-dev, Copyright (c) Zend Technologies ``` ### Operating System _No response_