[php-src] PR #24425: Fix GH-21974: Avoid destroying shared functions in ZTS

From: Date: Mon, 19 Oct 2026 11:26:57 +0000
Subject: [php-src] PR #24425: Fix GH-21974: Avoid destroying shared functions in ZTS
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39586@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24425 Author: Sree24-ui Fixes GH-21974. Problem In ZTS builds, a function disabled through an FPM pool's php_admin_value[disable_functions] setting can cause a use-after-free or crash during worker shutdown. After startup, a thread's function table contains borrowed pointers to functions owned by the global function table. Deleting a borrowed function through the normal destructor path can free an object that the global table still references. Fix When zend_disable_function() identifies a function in the borrowed-function prefix of the ZTS function table, it removes the entry without invoking its destructor, rehashes the table to preserve the borrowed-prefix invariant, and updates CG(copied_functions_count). The existing deletion path remains unchanged for other entries and for non-ZTS builds. Testing * Added an FPM regression test that disables system in a pool and checks that the worker exits cleanly after its first request. * On PHP-8.4 HEAD, the new test failed on unpatched release and ASan builds and passed on patched builds. * The patched release FPM suite reported 110 passed, 27 skipped, and 0 failed. * Repeated patched regression-test runs and a custom multithreaded embed-SAPI harness passed. The current validation used macOS builds. Linux/glibc, Windows, PHP-8.3, and a real multithreaded web-server SAPI have not been tested. Scope This change addresses the reported worker-shutdown issue. It does not attempt to address separate problems associated with calling zend_disable_function() during an active request.

« previous php.git-pulls (#39586) next »