[php-src] PR #25127: Fix free of uninitialized var in ext/date
| From: | dunglas | Date: | Sun, 01 Nov 2026 13:49:39 +0000 |
| Subject: | [php-src] PR #25127: Fix free of uninitialized var in ext/date | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40185@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25127
Author: dunglas
In ext/date, nitializes
last_errors in GINIT to prevent a free of the initialized var
in ZTS builds.
Claude generated details:
> In ZTS builds, TSRM allocates each thread's module globals with
> malloc(), and date's GINIT doesn't initialize
> last_errors: only RINIT sets it to
> NULL.
> ZEND_MODULE_POST_ZEND_DEACTIVATE_D(date) frees it when it isn't
> NULL, and php_request_shutdown()
> runs the post-deactivate hooks even when the modules were never activated.
>
> So when a thread's first request fails in php_request_startup()¡
> ¾†.}¸2áÔÍĸ<1 before zend_activate_modules() (for instance, a
> memory limit bailout in sapi_activate() or
> php_hash_environment()), the shutdown calls
> timelib_error_container_dtor() on uninitialized memory and the
> process crashes. Non-ZTS builds aren't affected because their globals live in zeroed static
> storage.
>
> This initializes last_errors in GINIT like the other pointers.
Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-CDG8FSAB. I made the PR public
because the issue can only a crash, under specific conditions.