[php-src] PR #25203: Fix use of freed argv in atexit handlers on macOS

From: Date: Thu, 05 Nov 2026 11:38:41 +0000
Subject: [php-src] PR #25203: Fix use of freed argv in atexit handlers on macOS
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-40317@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/25203 Author: GromNaN cleanup_ps_args() frees the argv copy installed by save_ps_args() in _NSGetArgv() and restores environ only. Handlers registered with atexit() run after it, so any of them that reads the process arguments gets freed memory. On macOS this crashes ext-mongodb at shutdown, because Cyrus SASL logs through ASL and asl_open() reads _NSGetArgv(). Restore the original argv pointer before freeing the copy, as is already done for environ. A regression test would need a C-level atexit() handler, which the PHPT format cannot express. I verified the change with an out-of-tree extension that reads _NSGetArgv() from an atexit() handler. With ZEND_DONT_UNLOAD_MODULES=1 so that the handler runs at process exit, the pointer is the freed copy without the patch and the original array with it. This targets PHP 8.3 because PHP 8.2 only accepts security fixes.

« previous php.git-pulls (#40317) next »