[php-src] PR #23595: TSRM: roll back id_count when the resource type table cannot grow
| From: | iliaal | Date: | Sun, 06 Sep 2026 15:07:32 +0000 |
| Subject: | [php-src] PR #23595: TSRM: roll back id_count when the resource type table cannot grow | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38345@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23595
Author: iliaal
ts_allocate_id(), ts_allocate_fast_id_at() and
ts_allocate_tls_id() each do id_count++ before growing
resource_types_table. If the realloc fails they return 0 with id_count still counting
the new slot, so resource_types_table_size < id_count from then on and
allocate_new_resource() walks j < id_count over an entry that was never initialized.
This targets master rather than a stable branch because it is unreachable without an allocation
failure, and TSRM.c has diverged. The PHP-8.4 shape has only two increment sites and puts one of
them in ts_allocate_fast_id(), which on master no longer increments at all, so the same
diff would be wrong there. No test: the branch needs a failing realloc during ZTS startup, which has
no userland surface. Verified against a --enable-zts build.