[php-src] PR #24500: [7.1] Backport CVE-2026-109618 and CVE-2026-109619 mitigation
| From: | ieth0 | Date: | Wed, 21 Oct 2026 19:18:32 +0000 |
| Subject: | [php-src] PR #24500: [7.1] Backport CVE-2026-109618 and CVE-2026-109619 mitigation | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39670@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24500
Author: ieth0
Backport the minimal end-of-life mitigation for CVE-2026-109618 and CVE-2026-109619 from PHP 7.4
commit https://github.com/php/php-src/commit/712e60f9edfd03f0960fc4fc3c2c375f42b90aa2
("Avoid state corruption via bailout") to
PHP-7.1.
The backport adapts the allocator, executor and hash APIs to PHP 7.1 and regenerates the VM header
with PHP 7.1's generator. It preserves the upstream mitigation's behavior:
- Exit immediately on allocation failure or guarded allocation overflow, without running cleanup
callbacks.
- Clear request, executor and SAPI state before heap reuse.
- Bound multipart body parts and retained headers, ignoring duplicate Content-Disposition and
Content-Type headers.
- Allocate initial input arrays with one bucket.
- Disable session upload progress, including when enabled through its INI setting.
NEWS and UPGRADING document the compatibility changes. Six new PHPTs cover hard OOM, input arrays,
multipart limits, duplicate headers and disabled upload progress; affected existing tests are
updated. A separate commit changes the existing 7.1.34-dev version to
7.1.34.
Validation of this exact branch on CentOS 7 x86_64:
- NTS and ZTS debug builds compile and report 7.1.34; both generated VM headers reproduce exactly.
- All seven focused tests pass in both builds.
- Selected core/session suites run 5,432 tests per configuration: NTS has 5,216 PASS, 208 SKIP and
seven existing XFAILs; ZTS debug has 5,221 PASS, 203 SKIP and seven existing XFAILs. Each initial
run also has one proc_nice_basic.phpt failure because the runner starts at niceness 10
and adding 10 reaches the Linux limit of 19. That test passes at normal priority in both builds.
- All nine isolated FPM checks pass, covering worker reuse, uploads, multipart header and part
limits, empty file controls, disabled upload progress, fatal-handler state reuse, and OOM skipping
cleanup with worker replacement.