[php-src] PR #24987: Fix GH-24802: guard request_parse_body() against reentrancy
| From: | lazerg | Date: | Wed, 28 Oct 2026 01:52:33 +0000 |
| Subject: | [php-src] PR #24987: Fix GH-24802: guard request_parse_body() against reentrancy | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40003@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24987
Author: lazerg
request_parse_body() has no reentrancy guard. If a user error handler that fires during
multipart parsing calls it again, the nested parse re-inits and destroys the process-global
PG(rfc1867_protected_variables). The outer parse then uses and frees that same table a
second time, so the worker crashes on a bad zend_string_release().
The function already keeps its state in SG(request_parse_body_context), so I added an
in_progress flag there. A reentrant call now throws
RequestParseBodyException instead of parsing again, and the flag is cleared on exit and
at the per-request reset points.
Fixes #24802