[php-src] PR #24719: Fix tempnam() not being disabled in the fuzzer SAPI

From: Date: Mon, 26 Oct 2026 06:15:48 +0000
Subject: [php-src] PR #24719: Fix tempnam() not being disabled in the fuzzer SAPI
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39892@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24719 Author: yumasansansan HARDCODED_INI in sapi/fuzzer/fuzzer-sapi.c disables functions with file system side effects, but lists tempname instead of tempnam. zend_disable_functions() silently ignores unknown names, so tempnam() is still callable. Running php-fuzz-execute on <?php tempnam("/tmp", "fuzzaudit_"); creates a file in /tmp; with this patch it does not. Other write paths remain and are not addressed here, as they cannot be blocked through disable_functions without losing coverage: error_log($msg, 3, $file) and new SplFileObject($file, "w") both write files below the open_basedir (/tmp).

« previous php.git-pulls (#39892) next »