[php-src] PR #25176: Fix unchecked request-body flatten errors in apache2handler
| From: | joshtrichards | Date: | Tue, 03 Nov 2026 17:40:05 +0000 |
| Subject: | [php-src] PR #25176: Fix unchecked request-body flatten errors in apache2handler | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40271@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25176
Author: joshtrichards
php_apache_sapi_read_post() checks ap_get_brigade() errors but ignores the
return value of apr_brigade_flatten().
If a bucket read fails during flattening, APR returns before updating the supplied length. The
callback then counts the requested length as successfully read, potentially reporting bytes that
were not written into the destination buffer.
Apache's core input filter normally reads socket buckets and propagates errors through
ap_get_brigade(), so ordinary network failures are already handled. This change
defensively handles any bucket-read failure occurring during the subsequent flatten operation; no
such failure has been demonstrated with the standard input-filter chain.
Check the flatten result after cleaning up the brigade and return zero on failure, matching the
existing handling of ap_get_brigade() errors. Successful reads are unchanged.
Related:
- #9949 / #10059