[php-src] PR #22986: Fix GH-19320: Prevent FPM UID and GID overflow
| From: | prateekbhujel | Date: | Sat, 01 Aug 2026 08:18:49 +0000 |
| Subject: | [php-src] PR #22986: Fix GH-19320: Prevent FPM UID and GID overflow | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37436@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/22986
Author: prateekbhujel
FPM parses numeric
user, group, listen.owner, and
listen.group values with strtoul(), but stores them in signed
int fields. That can silently change an ID before it reaches setuid(),
setgid(), or chown().
This stores the values in uid_t/gid_t and rejects IDs that the platform
types cannot represent during config validation. It also rejects the all-bits-one value used by
chown() as its no-change sentinel.
I added coverage for all four numeric directives and ran the full FPM test suite.
Fixes GH-19320