[php-src] PHP-8.2: Avoid state corruption via bailout

Author: Arnaud Le Blanc (arnaud-lb) Committer: Ilija Tovilo (iluuu1994) Date: 2026-10-21T16:06:22+02:00 Commit: https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19 Raw diff: https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19.diff Avoid state corruption via bailout - Replace bailout on OOM with UnwindExit - Properly reset various globals that may be accessed during startup Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618) Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com> Co-authored-by: Jakub Zelenka <bukka@php.net> Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com> Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com> Changed paths: A Zend/tests/oom_SplFixedArray___unserialize.phpt A Zend/tests/oom_SplFixedArray___wakeup.phpt A Zend/tests/oom_SplFixedArray_copy_ctor.phpt A Zend/tests/oom_SplFixedArray_fromArray_001.phpt A Zend/tests/oom_SplFixedArray_fromArray_002.phpt A Zend/tests/oom_after_main_script.phpt A Zend/tests/oom_array_fill_001.phpt A Zend/tests/oom_array_fill_002.phpt A Zend/tests/oom_array_fill_003.phpt A Zend/tests/oom_array_fill_004.phpt A Zend/tests/oom_array_pad_001.phpt A Zend/tests/oom_array_pad_002.phpt A Zend/tests/oom_array_pad_003.phpt A Zend/tests/oom_array_pad_004.phpt A Zend/tests/oom_array_pad_005.phpt A Zend/tests/oom_array_pad_006.phpt A Zend/tests/oom_array_pad_007.phpt A Zend/tests/oom_array_pad_008.phpt A Zend/tests/oom_call_function.phpt A Zend/tests/oom_call_function_002.phpt A Zend/tests/oom_call_function_003.phpt A Zend/tests/oom_debug_backtrace.phpt A Zend/tests/oom_debug_backtrace_args.phpt A Zend/tests/oom_debug_backtrace_named_args.phpt A Zend/tests/oom_error_get_last.phpt A Zend/tests/oom_exception_trace.phpt A Zend/tests/oom_hard_limit_exceeded.phpt A Zend/tests/oom_hard_limit_exceeded_during_complilation.phpt A Zend/tests/oom_interrupt.phpt A Zend/tests/oom_interrupt_unfinished_call_frame.phpt A Zend/tests/oom_interrupt_unfinished_call_frame_fiber.phpt A Zend/tests/oom_json_decode_001.phpt A Zend/tests/oom_json_decode_002.phpt A Zend/tests/oom_json_decode_003.phpt A Zend/tests/oom_json_decode_004.phpt A Zend/tests/oom_json_decode_005.phpt A Zend/tests/oom_json_decode_006.phpt A Zend/tests/oom_json_decode_007.phpt A Zend/tests/oom_pending_at_shutdown.phpt A Zend/tests/oom_range_001.phpt A Zend/tests/oom_range_002.phpt A Zend/tests/oom_range_003.phpt A Zend/tests/oom_range_004.phpt A Zend/tests/oom_request_parsing.phpt A Zend/tests/oom_soft_limit_exceeded.phpt A Zend/tests/oom_soft_limit_exceeded_fcall.phpt A Zend/tests/oom_soft_limit_in_callback.phpt A Zend/tests/oom_str_repeat.phpt A Zend/tests/oom_unserialize_001.phpt A Zend/tests/oom_unserialize_002.phpt A Zend/tests/oom_unserialize_003.phpt A Zend/tests/oom_unserialize_004.phpt A Zend/tests/oom_unserialize_005.phpt A Zend/tests/oom_unserialize_006.phpt A Zend/tests/oom_unserialize_007.phpt A Zend/tests/oom_unserialize_008.phpt A Zend/tests/oom_unserialize_009.phpt A Zend/tests/oom_unserialize_011.phpt A Zend/tests/oom_unserialize_012.phpt A Zend/tests/oom_unserialize_013.phpt A Zend/tests/oom_unserialize_014.phpt A Zend/tests/oom_unserialize_015.phpt A Zend/tests/oom_unserialize_016.phpt A Zend/tests/singleton_array.phpt A ext/bz2/tests/oom_bzcompress.phpt A ext/bz2/tests/oom_bzdecompress.phpt A ext/bz2/tests/oom_bzip2_decompress_filter.phpt A ext/curl/tests/oom_curl_exec.phpt A ext/curl/tests/oom_curl_multi_exec.phpt A ext/date/tests/oom_date_create.phpt A ext/date/tests/oom_date_create_immutable.phpt A ext/date/tests/oom_date_interval_create_from_date_string.phpt A ext/date/tests/oom_date_modify.phpt A ext/date/tests/oom_date_parse.phpt A ext/date/tests/oom_dateinterval_construct.phpt A ext/date/tests/oom_dateinterval_createfromdatestring.phpt A ext/date/tests/oom_dateperiod_construct.phpt A ext/date/tests/oom_datetime_construct.phpt A ext/date/tests/oom_datetime_modify.phpt A ext/date/tests/oom_datetimeimmutable_construct.phpt A ext/date/tests/oom_datetimeimmutable_modify.phpt A ext/date/tests/oom_strtotime.phpt A ext/dom/tests/oom_xpath.phpt A ext/exif/tests/oom_exif_big_thumbnail.inc A ext/exif/tests/oom_exif_numeric_metadata.phpt A ext/exif/tests/oom_exif_read_data_tags.phpt A ext/exif/tests/oom_exif_scan_jpeg_header.phpt A ext/exif/tests/oom_exif_thumbnail_large_file_001.phpt A ext/exif/tests/oom_exif_thumbnail_large_file_002.phpt A ext/exif/tests/oom_exif_thumbnail_tiff.phpt A ext/fileinfo/tests/oom_cdf_sector_chain.phpt A ext/filter/tests/oom_filter_default_encoded.phpt A ext/filter/tests/oom_filter_input.phpt A ext/filter/tests/oom_filter_input_array.phpt A ext/filter/tests/oom_filter_var.phpt A ext/filter/tests/oom_filter_var_array.phpt A ext/filter/tests/oom_filter_var_full_special_chars.phpt A ext/gd/tests/oom_imagecreatefrombmp.phpt A ext/gd/tests/oom_imagecreatefromgd2.phpt A ext/gd/tests/oom_imagecreatefromgd2_chunkbuf.phpt A ext/gd/tests/oom_imagecreatefromgd2_compbuf.phpt A ext/gd/tests/oom_imagecreatefromgd2part.phpt A ext/gd/tests/oom_imagecreatefromgd2part_chunkbuf.phpt A ext/gd/tests/oom_imagecreatefromgd2part_compbuf.phpt A ext/gd/tests/oom_imagecreatefromgif.phpt A ext/gd/tests/oom_imagecreatefrompng.phpt A ext/gd/tests/oom_imagecreatefromstring.phpt A ext/gd/tests/oom_imagecreatefromtga.phpt A ext/gd/tests/oom_imagecreatefromwbmp.phpt A ext/gd/tests/oom_imagecreatefromxbm.phpt A ext/gd/tests/oom_imagepalettetotruecolor.phpt A ext/iconv/tests/oom_iconv.phpt A ext/iconv/tests/oom_iconv_mime_decode.phpt A ext/iconv/tests/oom_iconv_mime_decode_headers.phpt A ext/iconv/tests/oom_iconv_mime_encode.phpt A ext/iconv/tests/oom_iconv_mime_encode_line_length.phpt A ext/iconv/tests/oom_iconv_stream_filter.phpt A ext/imap/tests/oom_imap_mime_header_decode.phpt A ext/intl/tests/oom_normalizer_normalize.phpt A ext/intl/tests/oom_normalizer_normalize_func.phpt A ext/intl/tests/oom_uconverter_convert.phpt A ext/intl/tests/oom_uconverter_transcode.phpt A ext/json/tests/json_decode_oom_utf8_substitute.phpt A ext/json/tests/json_encode_oom_escape.phpt A ext/json/tests/json_encode_oom_partial_output.phpt A ext/json/tests/json_encode_oom_pretty_print.phpt A ext/json/tests/json_encode_oom_string_prealloc.phpt A ext/mbstring/tests/oom_buf_growth.phpt A ext/mbstring/tests/oom_mb_convert_case.phpt A ext/mbstring/tests/oom_mb_convert_encoding.phpt A ext/mbstring/tests/oom_mb_convert_variables.phpt A ext/mbstring/tests/oom_mb_convert_variables_many.phpt A ext/mbstring/tests/oom_mb_decode_mimeheader.phpt A ext/mbstring/tests/oom_mb_encode_mimeheader.phpt A ext/mbstring/tests/oom_mb_encode_numericentity.phpt A ext/mbstring/tests/oom_mb_ereg_replace.phpt A ext/mbstring/tests/oom_mb_eregi_replace.phpt A ext/mbstring/tests/oom_mb_parse_str.phpt A ext/mbstring/tests/oom_mb_split.phpt A ext/mbstring/tests/oom_mb_str_split.phpt A ext/mbstring/tests/oom_mb_str_split_filter.phpt A ext/mbstring/tests/oom_mb_str_split_fixed_width.phpt A ext/mbstring/tests/oom_mb_str_split_length.phpt A ext/mbstring/tests/oom_mb_strcut_filter.phpt A ext/mbstring/tests/oom_mb_strcut_length.phpt A ext/mbstring/tests/oom_mb_strimwidth.phpt A ext/mbstring/tests/oom_mb_strtoupper.phpt A ext/mbstring/tests/oom_mb_substr_count.phpt A ext/mbstring/tests/oom_mb_substr_length.phpt A ext/pcre/tests/oom_preg_filter.phpt A ext/pcre/tests/oom_preg_match_all.phpt A ext/pcre/tests/oom_preg_match_captures.phpt A ext/pcre/tests/oom_preg_replace.phpt A ext/pcre/tests/oom_preg_replace_callback.phpt A ext/pcre/tests/oom_preg_replace_callback_array.phpt A ext/pcre/tests/oom_preg_split.phpt A ext/session/tests/rfc1867_incomplete_class_reserved_props.phpt A ext/session/tests/rfc1867_no_user_code.phpt A ext/simplexml/tests/oom_array_cast.phpt A ext/simplexml/tests/oom_json_encode.phpt A ext/simplexml/tests/oom_xpath.phpt A ext/soap/tests/oom_http_server.inc A ext/soap/tests/oom_soap_response.inc A ext/soap/tests/oom_soapclient_call.phpt A ext/soap/tests/oom_soapclient_dorequest_chunked.phpt A ext/soap/tests/oom_soapclient_dorequest_close.phpt A ext/soap/tests/oom_soapclient_dorequest_content_length.phpt A ext/soap/tests/oom_soapclient_response_headers.phpt A ext/soap/tests/oom_soapclient_soapcall.phpt A ext/soap/tests/oom_soapserver_handle_array.phpt A ext/soap/tests/oom_soapserver_handle_headers.phpt A ext/soap/tests/oom_soapserver_handle_parameters.phpt A ext/standard/tests/array/oom_array_chunk.phpt A ext/standard/tests/array/oom_array_map_zip.phpt A ext/standard/tests/file/fread_oom_chunk_size.phpt A ext/standard/tests/file/fread_oom_filter_chunk_size.phpt A ext/standard/tests/file/fread_oom_length.phpt A ext/standard/tests/file/oom_file.phpt A ext/standard/tests/file/oom_file_get_contents.phpt A ext/standard/tests/image/oom_getimagesize_cws.inc A ext/standard/tests/image/oom_getimagesize_cws.phpt A ext/standard/tests/image/oom_getimagesize_xbm.phpt A ext/standard/tests/image/oom_getimagesizefromstring_cws.phpt A ext/standard/tests/serialize/incomplete_class_raw_payload_markers.phpt A ext/standard/tests/streams/oom_stream_copy_to_stream_memory.phpt A ext/standard/tests/streams/oom_stream_get_contents.phpt A ext/standard/tests/streams/stream_get_line_oom_chunk_size.phpt A ext/standard/tests/strings/oom_explode.phpt A ext/standard/tests/strings/oom_implode.phpt A ext/standard/tests/strings/oom_levenshtein.phpt A ext/standard/tests/strings/oom_nl2br.phpt A ext/standard/tests/strings/oom_setcookie_value.phpt A ext/standard/tests/strings/oom_str_getcsv.phpt A ext/standard/tests/strings/oom_str_ireplace.phpt A ext/standard/tests/strings/oom_str_replace.phpt A ext/standard/tests/strings/oom_str_split.phpt A ext/standard/tests/strings/oom_str_word_count.phpt A ext/standard/tests/strings/oom_strtr.phpt A ext/standard/tests/strings/oom_substr_replace.phpt A ext/standard/tests/strings/oom_unpack.phpt A ext/standard/tests/strings/wordwrap_memory_limit_002.phpt A ext/standard/tests/strings/wordwrap_memory_limit_003.phpt A ext/standard/tests/strings/wordwrap_memory_limit_004.phpt A ext/tokenizer/tests/token_get_all_TOKEN_PARSE_oom_feedback.phpt A ext/xml/tests/oom_xml_parse_attributes.phpt A ext/xml/tests/oom_xml_parse_into_struct.phpt A ext/xml/tests/oom_xml_parse_ns.phpt A ext/xmlreader/tests/oom_xmlreader_getattribute.phpt A ext/xmlreader/tests/oom_xmlreader_getattributeno.phpt A ext/xmlreader/tests/oom_xmlreader_getattributens.phpt A ext/xmlreader/tests/oom_xmlreader_lookupnamespace.phpt A ext/xmlreader/tests/oom_xmlreader_readinnerxml.phpt A ext/xmlreader/tests/oom_xmlreader_readouterxml.phpt A ext/xmlreader/tests/oom_xmlreader_readstring.phpt A ext/zend_test/tests/zend_test_handle_post_data.phpt A ext/zlib/tests/oom_deflate_add.phpt A ext/zlib/tests/oom_gzcompress.phpt A ext/zlib/tests/oom_gzdecode.phpt A ext/zlib/tests/oom_gzfile.phpt A ext/zlib/tests/oom_gzgets.phpt A ext/zlib/tests/oom_gzpassthru.phpt A ext/zlib/tests/oom_inflate_add.phpt A ext/zlib/tests/oom_readgzfile.phpt A ext/zlib/tests/oom_zlib_inflate_filter.phpt A sapi/cli/tests/oom_request_parsing_next_request.phpt A sapi/cli/tests/oom_shutdown_function_next_request.phpt A tests/basic/GHSA-2cv3-554h-jpmh_multipart.phpt A tests/basic/GHSA-2cv3-554h-jpmh_urlencoded.phpt A tests/basic/GHSA-f883-x959-3vr9_001.phpt A tests/basic/GHSA-f883-x959-3vr9_002.phpt A tests/basic/GHSA-f883-x959-3vr9_003.phpt A tests/basic/GHSA-f883-x959-3vr9_004.phpt A tests/basic/GHSA-f883-x959-3vr9_005.phpt A tests/basic/GHSA-f883-x959-3vr9_006.phpt A tests/basic/GHSA-f883-x959-3vr9_007.inc A tests/basic/GHSA-f883-x959-3vr9_007.phpt A tests/basic/GHSA-f883-x959-3vr9_008.phpt A tests/basic/GHSA-f883-x959-3vr9_009.phpt A tests/basic/GHSA-f883-x959-3vr9_010.phpt A tests/basic/GHSA-f883-x959-3vr9_011.phpt A tests/basic/oom_rfc1867.inc A tests/basic/oom_rfc1867_array_upload_name.phpt A tests/basic/oom_rfc1867_early_report.phpt A tests/basic/oom_rfc1867_field_name.phpt A tests/basic/oom_rfc1867_files.phpt A tests/basic/oom_rfc1867_files_registration.phpt A tests/basic/oom_rfc1867_files_registration_full_path.phpt A tests/basic/oom_rfc1867_form_value.phpt A tests/basic/oom_rfc1867_header_continuation.phpt A tests/basic/oom_rfc1867_header_count.phpt A tests/basic/oom_rfc1867_long_header_line.phpt A tests/basic/oom_rfc1867_mb_encoding.phpt A tests/basic/oom_rfc1867_mb_skipif.inc A tests/basic/oom_rfc1867_post_vars.phpt A tests/basic/oom_rfc1867_session_skipif.inc A tests/basic/oom_rfc1867_skipif.inc A tests/basic/oom_rfc1867_target.inc A tests/basic/oom_rfc1867_upload_progress.phpt A tests/output/oom_in_internal_output_handler.phpt M Zend/tests/bug40770.phpt M Zend/tests/bug54268.phpt M Zend/tests/bug76846.phpt M Zend/tests/fibers/get-return-after-bailout.phpt M Zend/tests/gh11189.phpt M Zend/tests/gh11189_1.phpt M Zend/zend.c M Zend/zend_API.c M Zend/zend_API.h M Zend/zend_alloc.c M Zend/zend_alloc.h M Zend/zend_attributes.c M Zend/zend_attributes.h M Zend/zend_builtin_functions.c M Zend/zend_compile.c M Zend/zend_exceptions.c M Zend/zend_execute.c M Zend/zend_execute_API.c M Zend/zend_globals.h M Zend/zend_hash.c M Zend/zend_hash.h M Zend/zend_objects.c M Zend/zend_objects.h M Zend/zend_operators.c M Zend/zend_operators.h M Zend/zend_smart_str.c M Zend/zend_smart_str.h M Zend/zend_string.c M Zend/zend_string.h M Zend/zend_types.h M Zend/zend_vm_def.h M Zend/zend_vm_execute.h M ext/bz2/bz2.c M ext/bz2/bz2_filter.c M ext/curl/interface.c M ext/curl/tests/responder/get.inc M ext/date/lib/parse_date.c M ext/date/lib/parse_date.re M ext/date/lib/parse_iso_intervals.c M ext/date/lib/parse_iso_intervals.re M ext/dom/xpath.c M ext/exif/exif.c M ext/fileinfo/libmagic.patch M ext/fileinfo/libmagic/cdf.c M ext/filter/filter.c M ext/filter/sanitizing_filters.c M ext/gd/libgd/gd.c M ext/gd/libgd/gd_gd2.c M ext/gd/libgd/gd_tga.c M ext/gd/libgd/gdhelpers.h M ext/gd/libgd/wbmp.c M ext/iconv/iconv.c M ext/imap/php_imap.c M ext/intl/converter/converter.c M ext/intl/normalizer/normalizer_normalize.c M ext/json/json_encoder.c M ext/json/json_parser.y M ext/json/json_scanner.re M ext/libxml/libxml.c M ext/mbstring/libmbfl/filters/mbfilter_qprint.c M ext/mbstring/libmbfl/mbfl/mbfilter.c M ext/mbstring/libmbfl/mbfl/mbfl_encoding.h M ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c M ext/mbstring/mb_gpc.c M ext/mbstring/mbstring.c M ext/mbstring/php_mbregex.c M ext/mbstring/php_unicode.c M ext/opcache/ZendAccelerator.c M ext/opcache/ZendAccelerator.h M ext/opcache/jit/zend_jit_arm64.dasc M ext/opcache/jit/zend_jit_disasm.c M ext/opcache/jit/zend_jit_x86.dasc M ext/opcache/zend_file_cache.c M ext/opcache/zend_persist.c M ext/pcre/php_pcre.c M ext/session/php_session.h M ext/session/session.c M ext/session/tests/rfc1867_sid_invalid.phpt M ext/shmop/shmop.c M ext/simplexml/simplexml.c M ext/soap/php_encoding.c M ext/soap/php_http.c M ext/soap/soap.c M ext/spl/spl_fixedarray.c M ext/standard/array.c M ext/standard/assert.c M ext/standard/basic_functions.c M ext/standard/basic_functions.h M ext/standard/file.c M ext/standard/head.c M ext/standard/html.c M ext/standard/image.c M ext/standard/levenshtein.c M ext/standard/pack.c M ext/standard/php_incomplete_class.h M ext/standard/php_var.h M ext/standard/string.c M ext/standard/tests/GHSA-96wq-48vp-hh57.phpt M ext/standard/tests/streams/bug61115-1.phpt M ext/standard/tests/strings/chunk_split_variation3.phpt M ext/standard/tests/strings/str_pad_variation1.phpt M ext/standard/url_scanner_ex.h M ext/standard/url_scanner_ex.re M ext/standard/var.c M ext/standard/var_unserializer.re M ext/tokenizer/tokenizer.c M ext/xml/xml.c M ext/xmlreader/php_xmlreader.c M ext/xmlwriter/php_xmlwriter.c M ext/zend_test/test.c M ext/zend_test/test.stub.php M ext/zend_test/test_arginfo.h M ext/zend_test/tests/observer_bug81430_2.phpt M ext/zend_test/tests/observer_bug81435.phpt M ext/zend_test/tests/observer_error_01.phpt M ext/zend_test/tests/observer_fiber_functions_03.phpt M ext/zlib/zlib.c M ext/zlib/zlib_filter.c M main/SAPI.c M main/SAPI.h M main/main.c M main/php_variables.c M main/rfc1867.c M main/streams/memory.c M main/streams/streams.c M run-tests.php M sapi/fpm/tests/bug77023-pm-dynamic-blocking-sigquit.phpt M sapi/fuzzer/fuzzer-sapi.c M sapi/phpdbg/phpdbg.c M tests/output/gh15179.phpt Diff exceeded maximum size.