[php-src] PR #24476: Fix upload progress counters after separating the progress array

From: Date: Wed, 21 Oct 2026 10:37:31 +0000
Subject: [php-src] PR #24476: Fix upload progress counters after separating the progress array
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39654@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24476 Author: pdymidziuk With upload_progress.cleanup=0, a multipart request containing form data after its final file can persist an incomplete bytes_processed value. The end callback separates progress->data, then writes through a cached bucket pointer that still belongs to the previous array. Resolve the bytes_processed bucket from its current array on each access instead of storing pointers across multipart events. Preserve the existing in-place updates of progress arrays shared with session data. Add a regression covering two files followed by a large form field. It fails before this change and passes afterwards. Docker debug builds passed 267 session tests with one pre-existing XFAIL, plus all RFC1867 tests with USE_ZEND_ALLOC=0. This is a targeted correctness fix and hardening change, not a verified fix for CVE-2026-109618 or CVE-2026-109619. No RCE was reproduced.

« previous php.git-pulls (#39654) next »