[php-src] PR #25127: Fix free of uninitialized var in ext/date

From: Date: Sun, 01 Nov 2026 13:49:39 +0000
Subject: [php-src] PR #25127: Fix free of uninitialized var in ext/date
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-40185@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/25127 Author: dunglas In ext/date, nitializes last_errors in GINIT to prevent a free of the initialized var in ZTS builds. Claude generated details: > In ZTS builds, TSRM allocates each thread's module globals with > malloc(), and date's GINIT doesn't initialize > last_errors: only RINIT sets it to > NULL. > ZEND_MODULE_POST_ZEND_DEACTIVATE_D(date) frees it when it isn't > NULL, and php_request_shutdown() > runs the post-deactivate hooks even when the modules were never activated. > > So when a thread's first request fails in php_request_startup()¡ > ¾†.}¸2áÔÍĸ<1 before zend_activate_modules() (for instance, a > memory limit bailout in sapi_activate() or > php_hash_environment()), the shutdown calls > timelib_error_container_dtor() on uninitialized memory and the > process crashes. Non-ZTS builds aren't affected because their globals live in zeroed static > storage. > > This initializes last_errors in GINIT like the other pointers. Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-CDG8FSAB. I made the PR public because the issue can only a crash, under specific conditions.

« previous php.git-pulls (#40185) next »