[php-src] PR #24479: Reset serialization state before request input processing
| From: | jvoisin | Date: | Wed, 21 Oct 2026 13:00:43 +0000 |
| Subject: | [php-src] PR #24479: Reset serialization state before request input processing | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39658@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24479
Author: jvoisin
Serialization and unserialization contexts are stored in module globals, but their allocations
belong to the current request heap. If a bailout skips the normal context cleanup, those globals can
retain pointers to memory that is freed at request shutdown.
The next request can process input before module RINIT runs. In particular, multipart
upload-progress handling can invoke session serialization during input parsing, before the existing
RINIT reset. It may therefore observe the previous request’s stale context and lock state.
Resetting only in RINIT is too late to protect this path.
Clear the serialization lock and both context structures at the beginning of request startup, before
input processing. This discards the bookkeeping without following potentially invalid pointers or
running destructors. Remove the redundant reset from basic-module RINIT.
Add regression coverage that abandons serialize or unserialize state via a bailout, then sends a
multipart upload-progress request to the same worker. Verify the follow-up request sees cleared
state for locked and unlocked cases.
Validation: the regression passes with the startup reset alone and fails when both resets are
removed.