[php-src] PR #24500: [7.1] Backport CVE-2026-109618 and CVE-2026-109619 mitigation

From: Date: Wed, 21 Oct 2026 19:18:32 +0000
Subject: [php-src] PR #24500: [7.1] Backport CVE-2026-109618 and CVE-2026-109619 mitigation
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39670@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24500 Author: ieth0 Backport the minimal end-of-life mitigation for CVE-2026-109618 and CVE-2026-109619 from PHP 7.4 commit https://github.com/php/php-src/commit/712e60f9edfd03f0960fc4fc3c2c375f42b90aa2 ("Avoid state corruption via bailout") to PHP-7.1. The backport adapts the allocator, executor and hash APIs to PHP 7.1 and regenerates the VM header with PHP 7.1's generator. It preserves the upstream mitigation's behavior: - Exit immediately on allocation failure or guarded allocation overflow, without running cleanup callbacks. - Clear request, executor and SAPI state before heap reuse. - Bound multipart body parts and retained headers, ignoring duplicate Content-Disposition and Content-Type headers. - Allocate initial input arrays with one bucket. - Disable session upload progress, including when enabled through its INI setting. NEWS and UPGRADING document the compatibility changes. Six new PHPTs cover hard OOM, input arrays, multipart limits, duplicate headers and disabled upload progress; affected existing tests are updated. A separate commit changes the existing 7.1.34-dev version to 7.1.34. Validation of this exact branch on CentOS 7 x86_64: - NTS and ZTS debug builds compile and report 7.1.34; both generated VM headers reproduce exactly. - All seven focused tests pass in both builds. - Selected core/session suites run 5,432 tests per configuration: NTS has 5,216 PASS, 208 SKIP and seven existing XFAILs; ZTS debug has 5,221 PASS, 203 SKIP and seven existing XFAILs. Each initial run also has one proc_nice_basic.phpt failure because the runner starts at niceness 10 and adding 10 reaches the Linux limit of 19. That test passes at normal priority in both builds. - All nine isolated FPM checks pass, covering worker reuse, uploads, multipart header and part limits, empty file controls, disabled upload progress, fatal-handler state reuse, and OOM skipping cleanup with worker replacement.

« previous php.git-pulls (#39670) next »