[php-src] PR #24425: Fix GH-21974: Avoid destroying shared functions in ZTS
| From: | Sree24-ui | Date: | Mon, 19 Oct 2026 11:26:57 +0000 |
| Subject: | [php-src] PR #24425: Fix GH-21974: Avoid destroying shared functions in ZTS | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39586@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24425
Author: Sree24-ui
Fixes GH-21974.
Problem
In ZTS builds, a function disabled through an FPM pool's php_admin_value[disable_functions]
setting can cause a use-after-free or crash during worker shutdown.
After startup, a thread's function table contains borrowed pointers to functions owned by the
global function table. Deleting a borrowed function through the normal destructor path can free an
object that the global table still references.
Fix
When zend_disable_function() identifies a function in the borrowed-function prefix of the ZTS
function table, it removes the entry without invoking its destructor, rehashes the table to preserve
the borrowed-prefix invariant, and updates CG(copied_functions_count). The existing deletion path
remains unchanged for other entries and for non-ZTS builds.
Testing
* Added an FPM regression test that disables system in a pool and checks that the worker exits
cleanly after its first request.
* On PHP-8.4 HEAD, the new test failed on unpatched release and ASan builds and passed on patched
builds.
* The patched release FPM suite reported 110 passed, 27 skipped, and 0 failed.
* Repeated patched regression-test runs and a custom multithreaded embed-SAPI harness passed.
The current validation used macOS builds. Linux/glibc, Windows, PHP-8.3, and a real multithreaded
web-server SAPI have not been tested.
Scope
This change addresses the reported worker-shutdown issue. It does not attempt to address separate
problems associated with calling zend_disable_function() during an active request.