[php-src] PR #25203: Fix use of freed argv in atexit handlers on macOS
| From: | GromNaN | Date: | Thu, 05 Nov 2026 11:38:41 +0000 |
| Subject: | [php-src] PR #25203: Fix use of freed argv in atexit handlers on macOS | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40317@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25203
Author: GromNaN
cleanup_ps_args() frees the argv copy installed by save_ps_args() in _NSGetArgv() and restores
environ only. Handlers registered with atexit() run after it, so any of them that reads the process
arguments gets freed memory. On macOS this crashes ext-mongodb at shutdown, because Cyrus SASL logs
through ASL and asl_open() reads _NSGetArgv().
Restore the original argv pointer before freeing the copy, as is already done for environ.
A regression test would need a C-level atexit() handler, which the PHPT format cannot express. I
verified the change with an out-of-tree extension that reads _NSGetArgv() from an atexit() handler.
With ZEND_DONT_UNLOAD_MODULES=1 so that the handler runs at process exit, the pointer is the freed
copy without the patch and the original array with it.
This targets PHP 8.3 because PHP 8.2 only accepts security fixes.