[php-src] PR #24476: Fix upload progress counters after separating the progress array
| From: | pdymidziuk | Date: | Wed, 21 Oct 2026 10:37:31 +0000 |
| Subject: | [php-src] PR #24476: Fix upload progress counters after separating the progress array | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39654@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24476
Author: pdymidziuk
With upload_progress.cleanup=0, a multipart request containing form data
after its final file can persist an incomplete bytes_processed value.
The end callback separates progress->data, then writes through a cached
bucket pointer that still belongs to the previous array.
Resolve the bytes_processed bucket from its current array on each access
instead of storing pointers across multipart events. Preserve the existing
in-place updates of progress arrays shared with session data.
Add a regression covering two files followed by a large form field. It
fails before this change and passes afterwards. Docker debug builds passed
267 session tests with one pre-existing XFAIL, plus all RFC1867 tests with
USE_ZEND_ALLOC=0.
This is a targeted correctness fix and hardening change, not a verified
fix for CVE-2026-109618 or CVE-2026-109619. No RCE was reproduced.